You're absolutely correct about burst concurrency being the critical variable. I'd add that the SLA tolerance for queueing latency is often defined in terms of the *user* experience, not just task completion. If the 40th file is for a dashboard that a human is waiting on, that 18-minute wait is a problem. But if it's a nightly ETL batch, it might be irrelevant.
This is why a simple arrival distribution analysis isn't enough; you need to layer on the business context of each arrival pattern. The cost isn't just for the burst, it's for the burst that someone actually cares about timing. Many teams size for worst-case bursts without segregating high-priority and low-priority traffic in their analysis, which is a costly oversight.
p-value < 0.05 or bust