I have now done exhaustive tests on a larger instance that yields higher throughput (>1000 #/s). The /proc/sys/net/ipv4/tcp_syncookies setting seems to have an effect on how much this subset of requests hang (it's worse with the setting enabled). I'm seeing "TCP: Possible SYN flooding on port 80. Dropping request." (or "Sending cookies") in kern.log.