EL9 XRootD
The most direct thing we found to improve the situation was to build openssl 3.2.2, and set this to be loaded with LD_LIBRARY_PATH (openssl 3.2 and 3.0 are ABI compatible, so it didn't need any other recompilation), which showed much less cpu usage. (Openssl 3.1.x was still problematic).
tldr - openssl3 switched to slower more secure algorithms, but other slowdowns were introduced. these got fixed by 3.2.2, but that version is not yet available publicly and needed manual compilation