The 30 second answer
I open distributed traces from an APM or OpenTelemetry for the slow requests and look at the spans. Each span shows where time went: the database, our own code, a downstream HTTP call, or waiting for a connection. That tells me which layer to fix first, instead of guessing. I focus on the longest span on the critical path, because shortening anything else barely changes total latency.
A distributed trace is a tree of spans. Each span times one step (HTTP handler, SQL query, outbound call), so you can see whether time goes to the database, your code, or another service. The OpenTelemetry Java agent instruments JDBC, Spring and HTTP clients with no code changes.