Both distributors are running under the same profile, and the only difference in their parameters is that the distrib for the remote subscriber uses SQL authentification (-SubscriberLogin + -SubscriberPassword), whereas the local one uses integrated authent on behalf of the SQL Agent account.
This is nonsense I know.
May not be nonsense. I have witnessed extreme slowdown of replication (albeit on SQL2K) where the DC was a bit flaky, and didn't respond quickly, so the server elected to authenticate against a different (remote) DC. Forcing it back to its local DC made a HUGE difference.
If that's the only difference between the 2 subscribers, it's worth trying SQL authentication, even if it just rules that out as the cause of the problem.