I think we figured this out. WinSCP was defaulting to AES. Blowfish is MUCH faster. I suspect pscp is defaulting to blowfish. (haven't checked, though)
PSCP also uses AES be default.
Blowfish is plenty secure for us, so we just disabled AES on the server. blowfish gets used as fallback by winscp.
You can change the algorithm on SSH tab of login dialog.