Cache hit rate stuck at 40 percent

Start from what is being missed rather than the aggregate. The usual causes, in the order they occur:

• a Set-Cookie on responses that should be anonymous, which makes them uncacheable
• Cache-Control: private inherited from a framework default
• query strings used for analytics that fragment the cache key
• Vary: User-Agent, which effectively gives every device its own copy

Then normalise the key rather than removing the parameters. Most CDNs let you ignore a list of query parameters when computing the cache key, so analytics keeps working while ?utm_source=twitter stops creating a separate object.

91% is roughly the ceiling for a site with any personalised surface at all. Chasing the last few points usually means caching authenticated responses, which is where cache bugs turn into data leaks.