Find slow response on Centos/WHM possible DDOS?

I am searching for assistance in identifying the cause of slow response on my website. I have 6 virtual CPUs and 12 GB of RAM, and my CPU usage is rarely above 20%. Despite this, the response time is still poor. When I put the website into maintenance mode and wait for a few seconds before bringing it back up, the response is fast for a short period. I have observed that the connection count to my IP address increases to around 350 and this is where the slow response occurs. After putting the website into maintenance mode, the connections decrease to almost zero, but quickly increase when I bring it back up. I have run the following command to gather information about the connections: netstat -alpn | grep :80 | awk '{print $4}' |awk -F: '{print $(NF-1)}' |sort | uniq -c | sort -n. I suspect that the slow response may be due to data scraping from the 20 million plus pages I have, but it could also be a result of a DDOS attack. It is crucial that I find the root cause and fix it as soon as possible, and also prevent similar issues in the future. When checking connections with netstat -alpn | grep :80 | awk '{print $4}' |awk -F: '{print $(NF-1)}' |sort | uniq -c | sort -n 360 connections When I put Laravel in maintenance mode The connections quickly go down (17 or lower) over a minute or so When I put Laravel live the website response is fast again, but only for a minute or so