You could also do PHP profiling, using any of a number of profilers. My preferred is XDebug:
http://www.xdebug.org/docs/profiler
It does not require you to change any of your scripts.
This should quickly point out the bottlenecks; It will also help with the MySQL part. Even though MySQL has its own reporting, you may be in a situation where the script does the same (quick) query for 1000 times consecutively. MySQL would not report this, but you'd notice from XDebug that a function has been called that many times for just one page.
You may do an initial survey on a dev server; any optimization problems will show up quickly. From your production logs find out which are the most visited pages and analyze them first on the dev server.
If you still need to do profiling on the production server, consider enabling it randomly for a subset of the requests to minimize load. From the docs:
You can also selectively enable the profiler with the xdebug.profiler_enable_trigger setting set to 1. If it is set to 1, then you can enable the profiler by using a GET/POST or COOKIE variable of the name XDEBUG_PROFILE
Apache mod_rewrite will help in adding the GET variable transparently without it being passed to/from the user.