Obviously the scripts are coming from Moodle code ...
what you shared was accessing the front page of your site?
In a moodle 3.8 of code:
find ./moodle38/ -name service.php
* ./moodle38//admin/webservice/service.php
./moodle38//lib/ajax/service.php
./moodle38//mod/lti/service.php
I suspect?? yours is the service.php script that shows a session key exchange might be a webservice which could be an android or iOS device using the Moodle app or a custom app?
* Web services admin UI
Where in your setup is moodledata/sessions?
How many of your students use device and mobile app over browser on a 'typical workstation' (like laptop)?
The other script seeking/passing session key:
find ./moodle38/ -name setuserpref.php
./moodle38//lib/ajax/setuserpref.php
* Code to update a user preference in response to an ajax call.
Wonder if this would be called if student first viewed the site with mobile
app than opted to open moodle with a browser.
So your DB for the site is performing at max efficiency?
An admin user accessing any moodle always takes longer than student as much more data is exchanged. Does it look any different if you access the site as a student? as a teacher?
Difficult to determine exactly, isn't it! :|
'SoS', Ken