My CPU usage generally looks OK to me. It's easy to blame server resources, but is adding (expensive) capacity really necessary? I'd like to see some evidence before doing that. In particular, if it's due to an attack I'd rather block the attack than spend money helping the attackers, therefore...