Two things that stick out:
1. Quering the database for routes. We need to look at caching this, possibly using CacheCollector?
Most requests only need to check a handful of routes (unless it's the toolbar tree), most routes on the site are admin paths that hardly ever get visited. Cache routes by role or something?
2. Request::create() takes over 3ms all by itself. What about Request::duplicate(), or don't mock the request for router access check since that doesn't really make sense anyway.
PASSED: [[SimpleTest]]: [MySQL] 59,126 pass(es).
PASSED: [[SimpleTest]]: [MySQL] 58,582 pass(es).
PASSED: [[SimpleTest]]: [MySQL] 59,009 pass(es).