There is not really a non expensive way except for the debughook, which is CPU expensive to use. From my perspective, the more complex you make this threshold mechanism, the faster your server will be downed.
For sensitive events attached to for example a database, you want to have some kind of firewall, for example:
checkPassiveTimer (utility with clean-up)