Looking at uberAgent's "Session Logon Time" dashboard you notice that for some logons the value for "GP logon script" is larger than the value for "Total duration".
Most likely your group policy logon scripts are not configured to run synchronously. By default, Explorer is started before logon scripts have finished. Thus the desktop appears earlier and the logon seems to be faster. Many administrators do not want this - they want to make sure all customizations are in place when the desktop is displayed. That is why synchronous script execution is often enabled.
In any case with uberAgent the total logon duration is defined as the time from the actual logon until the shell is fully initialized. If logon scripts are still running (potentially invisibly) when the second point in time is reached then the script execution duration can be longer than the total logon duration.