In context configuration for webapps, which may be in ./conf/Catalina/localhost/.xml, ./webapps/.xml, or within ./conf/server.xml, I set reloadable="false". This prevents Tomcat from constantly polling for changes to the webapp's class files and jars, which is an unnecessary load. See the Context configuration documentation.
<Context path="/myapp" reloadable="true">
In ./conf/server.xml I go through and comment out bits I'm not using, such as unused connectors.
In ./conf/server.xml, look at the values for maxThreads, connectionTimeout, and similar attributes of the Connectors. There is no standard recommended value for these, you need to work out the optimal values based on your application, usage patterns, etc. See the documentation for the HTTP Connector and the AJP Connector for details.
I also strip out the default webapps, except for the ones I need.
Since I do use the tomcat-manager webapp, I lock it down. I configure the user account to access it, and configure Apache httpd access controls on the URL to lock access to relevant IP addresses.
Order deny,allow
Deny from all
Allow from 127.0.0.1
Allow from 192.168.0
Also in Apache, I block access to the WEB-INF directory (I don't have an example to hand).