The 20% per second does exist (its really more like 5% instant and 20% per second for 3 seconds), but it doesn't quite work like a limit, but rather scales the increase by time passed since essentially the last request.
If you request any increase, and 0.15s second passed since the last increase, you get a 20% * 0.15 seconds = 3% increase at most (eg. min(3%, request))
The first request goes through unlimited (other then the 5% per request limit), afterwards you get the 20% per second limit, for 3 seconds. The first request can't really be time-limited as it has no time window.
Of course you also can't go above 5% per request, so to exhaust the limit you need 5 requests per second (an initial one to kick-off the timer, and 4 more to consume the 20%).
So what you are seeing in the 100ms scenario seems sensible to me. The first request gives you full 5%, afterwards you are limited to apparently 3% per request (rather then 2%), which might be accounted for by response time of the MCWS calls spacing them slightly over 100ms.
Maybe logging with timestamps at the responses might be clearer.
I think the gradual limiting of requests is much more sensible then giving you 20% in less requests and then stone-walling the requests until the timer expires. Of course it assumes there is more requests coming, but protection is designed for a user-interaction scenario, so there usually are.