The other thing to remember about localhost is that everything is right there. You don’t go to another machine for your DB, you don’t have to traverse the net at all just to get to ‘home’ because you’re on the server. I suspect if you logged into the server directly (no you can’t, sorry), and loaded the page, it too would fly because it’s local.
Which is CRAZY annoying, BTW. Makes me drink more coffee.
I pulled up the ticket (sorry about the delay, we had off-site training classes this week which messes my schedule!) and the first thing that jumped out at me is that our tool wp-cli doesn’t work at all. That lead me to look at your plugins and you have a LOT of plugins.
Now I’m not a member of the “ZOMG! More plugins are BAD!” club, because it’s not about the number of the plugins, but WHICH plugins.
Step one for you is turning 'em off. Yeah, I know, I know. I would remove the Google Analytics (because you can use Page Speed Optimization to include that without touching WP, AND Page Speed Optimization works well with BuddyPress and obviates the need for other minification plugins). I’d also dump wp-crontrol and p3-profiler for a ‘real’ test. Those are okay for debugging, but you shouldn’t leave them (or all the logging that you have on in your wp-config) on all the time.
Speaking of the wp-config, you’ve got ‘cache’ defined twice. That won’t break stuff, but it’s still not a great idea.
Personally I don’t use anything like wordfence because while I like the idea of keeping things secure, I don’t think that having WP do it’s own security is good for performance. Puts too much weight on WP (same as why I don’t like caching unless I need it). Of course, you’re on a VPS, so you can turn on x-cache and hook W3TC into that and make the dyanmic cache faster. Also don’t forget to use browser caching in w3tc. Totally worth it.