This is the flame graph during full chain download and validation on the big box. Everything starting with secp256 is signature verifications by the NuGet build of libsecp256k1. The smaller unnamed stacks to the right are (1) reading blocks to validate, (2) reading prevouts for validation, (3) block destruct, (4) block.accept(), (5/7) store block, (6/8) deserialize block.
(edited)