You might want to give a centralized logging application like
Splunk a try. Or just mine/munge the logs directly since it's only two servers. That's assuming you have ruled out network or OS related issues. If not, I would investigate there first because e.g. if the second server is slower to respond then more clients will end up being managed from the first server. Compare the routing tables, etc. too. Heck, at half the traffic just running Wireshark on the two might give you some clues.
Update: You might also want to check out David Cross's book Data Munging with Perl.
Elda Taluta; Sarks Sark; Ark Arks
