Ok, after monitoring, tweaking a lot of stuff, you can see where we were all good, then got hit maliciously, implemented further tools, and have since then been A-OK. With additional server performance tuning, hopefully, fingers crossed, we can take a hit again without so much issue to users...