If we assume 1 request per device per second and an average execution time of 1s, then we'd reduce our capacity by ~11 by making all requests take 11s, because all processing slots in php-fpm will be occupied.
So while this should work well for protecting e.g. imap from getting overloaded, we may introduce another bottleneck....

I suppose we could alleviate this by tracking the actual rate of a device, and gradually bumping the sleep accordingly.

We can also separately return 503's, and if the client respects it we never run into the sleeps (if we track the rate).