The intermittent nature of your CPU spikes suggests it's probably triggered by specific events rather than constant load, which actually makes it easier to diagnose once you know what to look for. With that server spec and only 32GB RAM, you should be handling WordPress fine unless something's seriously misconfigured or you're getting hit by bots. First thing to do is check your access logs during those spike times to see if there's a pattern - look for suspicious user agents, repeated requests to specific URLs, or traffic from weird IP ranges. A lot of times high load comes from aggressive crawlers, comment spam bots, or someone hammering your wp-login.php or xmlrpc.php files trying to brute force their way in.
For WordPress specifically, WooCommerce is notorious for causing performance issues especially if you have a lot of products or complex queries running. Install Query Monitor plugin temporarily to see what database queries are slowest and which PHP processes are eating resources. You can also enable slow query logging in MySQL to catch problematic database operations - anything over 2 seconds is a red flag. Check your WooCommerce transients in the database because those can bloat out of control and cause issues. Also look at your wp-cron jobs because if you have plugins scheduling heavy tasks that overlap, that'll spike your CPU. You might want to disable wp-cron and set up a proper server-level cron job instead for better control.
On the server side, install and run htop or atop during a spike to see exactly which processes are consuming CPU - this will tell you if it's PHP, MySQL, or something else entirely. Use tools like New Relic or basic server monitoring to track resource usage over time so you can correlate spikes with specific actions. Check your PHP-FPM or Apache logs for slow requests and enable PHP slow log to catch scripts taking too long to execute. My bet is either you're getting bot traffic that needs to be blocked at the firewall level, or WooCommerce is running some inefficient query on product pages or checkout. Once you identify the specific URLs or processes causing spikes, you can either optimize that code, add caching with something like Redis or Memcached, or use Cloudflare to filter bot traffic before it even hits your server. Also make sure your WordPress install and all plugins are updated because old versions can have performance bugs that got fixed in later releases.
