The long time of "mount" looks fishy. Are you sure you are booting with a clean filesystem?
Other than that we see that
- we start too much (cron, gdm, ...) for our use case
- too many shells started to parse shell scripts
As for finding files writes to on boot, using a "find / -mtime -2" or some variation to pick up files modified since boot is easiest.
You can also to keep rootfs read only (ro in cmdline and don't remount it with rw) to track redundant writes.