If you turned off the bruteforce protection, there shouldn’t be any entries in the database.
Can you bypass the load balancer and see if a direct login on the server is faster? For NC12, they did change quite a lot of the CSS stuff and with reverse proxies, there is perhaps something broken.
@juliushaertl do you have any ideas regarding these errors? Or you know who to ask?