You can look at the requests data / response data via Developer Tools in your browser (usually F12, but depends on your browser). That might give you some indication of the direction to investigate.
Personal Opinion
Personally, I have disabled xmlrpc.prg on all of my sites. It is an easy way for a hacker to attack your site, either with a DDOS, or even a brute force attack on your login page. The xmlrpc.prg allows the hacker to ‘stack’ multiple requests into one reqeust.
In fact, I had to de-hack a site that was compromised due to an apparent xmlrpc.prg attack. They modified files, inserting some obfuscated code.
You might want to investigate if your site really needs to have xmlprc.prg enabled. You can disable it with this command in your functions.php file:
add_filter('xmlrpc_enabled', '__return_false');
You can also deny access via your htaccess file:
# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
# allow from xx.xx.xx.xx #add allowed IP addresses
</Files>
Note that disabling xmlrpc.prg may cause problem with remote posting processes.