From my personal experience as an ISV employee, I can say that this is pretty normal during the weeks leading up to a release. Here's the problem: ISVs are given about a month before the release hits to submit bugs, fix their own bugs, scan for security reviews, etc. All those ISVs are busy running scans and so on to make sure their code won't break in the next release.
In other words, each new release generates a ton of work for everyone. Checkmarx is just one kink in the process. The Security Review Team typically gets backed up 2-4 weeks before a release, Checkmarx's free scanner gets clogged up with pre-release checks, Partner Support gets swamped with support requests, etc. There's only so many resources available, both in terms of hardware and employees, so they have to make some compromises. In about a month or so, everything will be fine until June or so...
If you absolutely need to get scanned "yesterday," you might need to shell out for the on-premise version. In addition to faster scans, you also get unlimited lines of code (LOC) scanning, while the free version is limited to the number of resources it will scan. The free tool is really rather meant for smaller ISVs, and not the likes of Astadia and Blue Wolf, much like a Developer Edition is meant more for "small" developers, while the ISV Developer Editions have significantly more capacity in terms of storage, licenses, etc.
I've personally seen scans that were received within the hour, and scans that were measured in weeks. There's really no way to know how long it will take, because each request is a different size, different complexity, etc. There's no "progress bar" that CheckMarx can just look at to tell you a time estimate. Some orgs can be scanned in seconds, others may take minutes or hours of actual CPU time. It would be meaningless to provide an estimated time remaining.