As usual, I would suggest measuring this for your specific scenario.
Having said that, I'm not sure that I advise scanning all the way to the classes. If you do not control the class path (this is your client or similar), they can potentially add something to it, and your process will scan everything that falls into their class path (possibly not related to your application).
I would suggest that you only assign specific directories / repositories to which classes can be downloaded, and in this way you limit the scanning of the class path and reduce the chance of inadvertently collecting materials that you do not intend to do.
source share