Which of the following will MOST likely fix the issue?

Additional CPUs address CPU-bound bottlenecks; slow response caused by AV-intercepted file I/O is not a compute-bound problem.

A network cable replacement fixes physical-layer connectivity faults and does not affect software-level file access latency introduced by antivirus scanning.

A second web server with a load balancer distributes incoming traffic but replicates the same antivirus overhead on each node, leaving the root cause unresolved.

More RAM helps memory-bound or cache-starved workloads; AV-induced I/O interception is not resolved by increasing available memory.

Real-time antivirus scanning intercepts every file-read operation the web server performs against the web root, adding overhead to each HTTP request served. Excluding the web root directory from antivirus scanning eliminates this I/O bottleneck and restores expected response times. This is a standard performance tuning step recommended by most AV vendors when protecting web server hosts.