From my experience its almost always the database. On any sufficiently complex web app with a ORM its easy to trigger literally 100 queries by loading a single page if you don't make a specific effort to avoid it.