On the Tideways.com blog there's a tutorial talking about the "unknown performance bottleneck" that can be caused by PHP's own session garbage collection. This garbage collection happens when sessions expire and they need to be removed from the current set/data source.
Here is one performance setting in your PHP configuration you probably haven't thought about much before: How often does PHP perform random garbage collection of outdated session data in your application? Did you know that because of the shared nothing architecture PHP randomly cleans old session data whenever session_start() is called? An operation that is not necessarily cheap.
It's his general advice to avoid PHP's random garbage collection (it happens one in every 1000 requests, randomly) and opt for a more consistent method using background scripts. He gives an example using the Laravel framework and it's modified session garbage collection happening every 50th request (making use of the Symfony Finder component). He points out the problem with its implementation and the negative impact it could have on large, highly used applications. They share some of their own statistics and how to change this default (modifying the lottery option and making a custom "cleanup" command).