Jeffrey,
I'm told that the alternative to tokengroups would be recursive LDAP queries. Which would be expensive for the clients, particularly with heavily-nested subgroups.
Prior to us using tokengroups, we tried to limit the cost of these LDAP queries by limiting the LDAP query depth to false.
Interestingly, we also formerly used to have problems with global AD group memberships not being properly reflected. Our solution was to promote any such global groups up to universal groups and then the membership was seen.
But for performance reasons, we started using tokengroups. We haven't seen this global group problem in a while. Interesting (and totally obscure!!) that it's related to use of tokengroups.
BTW, if tokengroups is an expensive operation on AD DCs, seems like your AD team needs to size your AD DCs appropriately. Doesn't seem reasonable to throttle clients, due to some DC hardware.
Spike