@Qgil told me the site is slow to load once a day - we addressed this in fundraising by turning off checks that are slow when behind a firewall - ie
@Dwisehaupt
select * FROM civicrm_status_pref WHERE is_active = 0;
+----+-----------+----------------------------------+------------+-----------------+-------+------------+-----------+
| id | domain_id | name | hush_until | ignore_severity | prefs | check_info | is_active |
+----+-----------+----------------------------------+------------+-----------------+-------+------------+-----------+
| 1 | 1 | checkLastCron | NULL | 0 | NULL | 1546988405 | 0 |
| 2 | 1 | checkExtensions | NULL | 0 | NULL | NULL | 0 |
| 10 | 1 | checkResourceUrl | NULL | 0 | NULL | NULL | 0 |
| 11 | 1 | checkUploadsAreNotAccessible | NULL | 0 | NULL | NULL | 0 |
| 12 | 1 | checkDirectoriesAreNotBrowseable | NULL | 0 | NULL | NULL | 0 |
| 13 | 1 | checkVersion | NULL | 0 | NULL | NULL | 0 |