Was having similar issues but due to traffic. Even after upgrading to a business cloud package was still getting spikes in server resources. Finally fixed it and here's what I did.
- Lockdown wp-login.php in Cloudflare firewall
- xmlrpc.php lockdown
- Just for the hell of it I did the same with my wp-admin page
- Disabled the cron jobs within Wordpress and moved them to my server
Still seeing some 503 errors as hackers seem to be spoofing Cloudflare IP's but not effecting my server resources.
Hope this helps
____________________
|