Probably the server. Might specifically be the database, but without knowing the breakdown it's hard to tell.
So, first turn on Page Parse Time display, so you can see the whole-page-time and query-specific portion of that time, in the footer of each page:
admin > config > logging > Display The Page Parse Time > set to true
Explained more here: http://www.zen-cart.com/content.php?145
Post back with the numbers you get on various pages, like home page, product-listing/category page, product page, privacy page. The differences between those kinds of pages can be revealing.
Then you could work through this checklist: http://www.zen-cart.com/content.php?63-how-do-i-speed-up-my-site
.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole
Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.