I am having trouble decrypting a WCF trace file, and I hope someone can help me determine where in the pipeline I'm carrying latency. The trace for Processing Message XX is shown below, where there appears to be a 997 ms delay between the action boundary and the transfer to the Process Action, where my service code is executed (which takes about 50 ms).

First, I'm not sure if I understand the "Time" column correctly to represent the start time for an activity item. I believe this is because drilling in the Action Processing trace displays a list of actions with the first timestamp equal to the timestamp shown in the trace above for the Processing Action element.
My main question is: how to determine what happens during this period of time? When I read about the service trace viewer, it seems that this type of activity includes “transport or security processing”, which makes me think that this is a network problem, but I can’t be sure.
In case it matters, the following is a snapshot of the scan to the "Process" process trace.

- , , ?
( , ~ 60 , , , )
!