Огромное спасибо за совет, после включения
error_log /var/log/nginx/error.log info;

в логах сразу стало видно что идут сработки
2011/04/19 14:31:17 [warn] 80096#0: *7 delaying request, excess: 5.690, by zone "one", client
2011/04/19 14:31:17 [warn] 80096#0: *42 delaying request, excess: 6.363, by zone "one", client
2011/04/19 14:31:19 [warn] 80096#0: *10 delaying request, excess: 3.730, by zone "one", client
2011/04/19 14:31:20 [warn] 80096#0: *10 delaying request, excess: 0.770, by zone "one", client
2011/04/19 14:31:20 [warn] 80096#0: *42 delaying request, excess: 1.770, by zone "one", client
2011/04/19 14:31:20 [warn] 80096#0: *10 delaying request, excess: 1.780, by zone "one", client

перенес
limit_req zone=one burst=10;
в только в нужные локации

И все нормализовалось.

--
Сергей
http://unix-expert.ru