philpem, Sometimes it's hard to figure out why a server is moving like hot wax down a cold lead pipe. Other times you run GoAccess against the logs and it becomes very, very clear.
Fail2ban configured, StopForumSpam blocklist imported, and now that problem is solved.