We use VMware with Linux. Apache & PHP7 on one box. Maria DB on the other. We use LDAP authentication. The server specs are only 2 CPUs which operate at about 20% most of the day. 8Gig of RAM. Average users are between 60 and 100 throughout the day. Peaks at 150 to 200 during certain hours of the day.
Splitting application from database as well as switching to Apache Event MPM made a huge difference.
We use Apache Event MPM which made a huge difference over the default of prefork. I am not a server expert but we always seemed to have bottlenecks with prefork. Most of these probably stemmed from us not knowing how to set it up properly. However, since switching to Event MPM it has been very fast and seems to handle the various loads throughout the day. Making sure that the MPM is configured as well as the PHP-FPM seemed to make a difference as well. We also increased some of the MARIA DB caches and settings.
If the logins are the issue then maybe it is more appropriate to look there first. What authentication are you using? We use LDAP and the only time we have issues with login are when that LDAP server acts up or there are networking issues.