TLDR: Your Let's Encrypt certificate may have an RSA private key. Go's TLS implementation is far better optimized for ECDSA keys. Switching from RSA to ECDSA saves about 95% of CPU cycles due to the better implementation.