UEM runs during the 'User GPO Apply Time', so it could still be UEM. Please share a UEM logfile from a case where the logon time was so long.
In a next version of UEM we are looking to integrate with the Logon Monitor in order to specify the time used only for UEM to make logging and troubleshooting easier.
