A cloud engineer receives reports that roughly one-third of users of a web application are experiencing slow page loads and occasional errors, while the rest of the users report no issues. The application runs behind a load balancer distributing traffic across three application servers, each with its own local in-memory session cache. Health checks on all three servers pass, and CPU and memory metrics look normal across the fleet. Following a structured troubleshooting methodology, what is the MOST likely cause the engineer should investigate first?