@Carrie Conner good question, and honestly the timing angle is the right place to look. The STM32WB07 handles AES-128 in hardware so the crypto itself isn't adding meaningful CPU latency — but where I'd focus is on whether the encryption overhead is affecting your connection interval timing at all, because at low SNR you've got very thin margins for when packets need to arrive and be acknowledged.
The retransmit counts you're seeing are more likely link margin variation than crypto processing, especially if you're operating anywhere near the edge of your range budget. At 20km+ you're dealing with whatever multipath and atmospheric variation exists in your environment, and that alone can cause retransmit spikes that look weirdly periodic. I'd log your RSSI and retransmit counts together over time and see if the retransmit spikes correlate with RSSI dips — if they do, it's the link, not the crypto.
One thing worth checking though: if you have any software-side crypto wrapping on top of the hardware AES (session management, key exchange logic, anything like that) running on the same core that handles connection events, that could theoretically cause timing jitter. Worth profiling if you've got anything in that category.
