Hi,
I don´t know if you ever found the solution to this problem but I saw in an environment recently lots of problems with log-on time.
When I investigated further in the debug-level logs, I found that it was taking a very long time to map some network printers.
In particular printers that were connected by USB locally to a user´s computer then shared on the network from there.
Go through the debug-level logs from the beginning of the logon process and look at the time stamps, looking for any jumps in time frames.
Another thing I saw that chewed up a lot of time for DEM was the application of the Google Chrome profiles.
Chrome by default stores a really huge amount of info in a user´s profile.
If you already sorted this out, well done.
Regards