Looks like this might have been our problem.
47.76.99.127 United States 375,004 375,004 3.86 GB 18 Oct 2024 - 16:05
47.76.209.138 United States 374,807 374,808 3.85 GB 18 Oct 2024 - 16:05
I blocked all three networks allocated to Alibaba.
NetRange: 47.74.0.0 - 47.87.255.255
CIDR: 47.76.0.0/14, 47.80.0.0/13, 47.74.0.0/15
NetName: AL-3
NetHandle: NET-47-74-0-0-1
Parent: NET47 (NET-47-0-0-0-0)
NetType: Direct Allocation
OriginAS:
Organization: Alibaba Cloud LLC (AL-3)
RegDate: 2016-03-17
Updated: 2017-04-26
Ref: https://rdap.arin.net/registry/ip/47.74.0.0
The mysql usage has dropped dramatically. Hopefully, responsiveness will return to normal.