Heartbeat is polling admin-ajax every fifteen seconds

The Heartbeat API keeps post locks and autosave working by posting to admin-ajax.php on a timer — every fifteen seconds in the editor, every sixty elsewhere in the admin. Ten editors with a tab open is a steady background load on a server that looks idle.

add_filter( 'heartbeat_settings', function ( $settings ) {
    $settings['interval'] = 60;   // 15-120 seconds
    return $settings;
} );

// or stop it where it is not needed
add_action( 'init', function () {
    if ( ! is_admin() ) {
        wp_deregister_script( 'heartbeat' );
    }
} );

Turning it off wholesale breaks post locking, so two people editing the same post stop being warned about each other — which is worth more than the requests on most sites. Lengthening the interval is the safer adjustment. It is worth knowing about mainly because it makes the access log look like traffic and shows up in APM as the most-called endpoint on the site.