Reboot taking 40 minutes on XGS 3100

You could put a Serial Console on it and dump the session for next time (or to reproduce it).

https://support.sophos.com/support/s/article/KBA-000003810?language=en_US

MobaxTerm gives option to record the entire session. I have even a Raspberry PI, which dumps all console output (from USB) to a log file (very handy for this subject in general, not only for Sophos). 

I can do this but it will have to wait until I have swapped it out of production. The I/O errors from the log don't look good and I can't afford to be offline 40 minutes every time I try something. Access to everything goes through the XGS, not just the WAN.

I like the idea of the raspberry PI but I don't have enough knowledge to set one up easily and it wouldn't be worth the time investment to learn how for how often I would use it. I'll just have to make do with a boring old laptop. Sounds neat though.

I can do this but it will have to wait until I have swapped it out of production. The I/O errors from the log don't look good and I can't afford to be offline 40 minutes every time I try something. Access to everything goes through the XGS, not just the WAN.

I like the idea of the raspberry PI but I don't have enough knowledge to set one up easily and it wouldn't be worth the time investment to learn how for how often I would use it. I'll just have to make do with a boring old laptop. Sounds neat though.

The first step would be to know, what the appliances does, when it boots. 
It sounds to me like extensive checkups. Because your log will indicate when "Linux Kernel" is loaded, and if your time is boot+40 minutes in the logs, that indicates, the system is not loading Linux and doing checkups all the time.

The serial session will give more insight, what the appliance is doing.

You do not have a HA Cluster? Because it would be interesting to know, if both appliances have the same issue.