winbindd has a 'passdb' backend that uses internal RPC to access the passdb. On the AD DC the sam.ldb file is re-opened over and over again as a new connection is made for every lookup.
Created attachment 14066 [details] patch
Most likely fixed by fc9150dcab231fe9beb72e198b0c2742d5f2505f for 4.9.0