See http://pyzor.sourceforge.net/ for more information about Pyzor.
As most clients should not be auto-reporting these checksums, you should set this to a relatively low value, e.g. 5.
You can configure Pyzor to have its own per-server timeout. Set this plugin's timeout with that in mind. This plugin's timeout is a maximum ceiling. If Pyzor takes longer than this to complete its communication with all servers, no results are used by SpamAssassin.
Pyzor servers do not yet synchronize their servers, so it can be beneficial to check and report to more than one. See the pyzor-users mailing list for alternate servers that are not published via 'pyzor discover'.
If you are using multiple Pyzor servers, a good rule of thumb would be to set the SpamAssassin plugin's timeout to be the same or just a bit more than the per-server Pyzor timeout (e.g., 3.5 and 2 for two Pyzor servers). If more than one of your Pyzor servers is always timing out, consider removing one of them.