How to identify the problem of a slow site opening?

Question

1C-Bitrix

Hello.

There is a visited site, about 1.5-2 million page views per day. With traffic of 0.3-0.5 TB / day. Recently, for no apparent reason, any pages of the site periodically (not constantly) began to open slowly (with a timeout). Either quickly, in less than 1 second, then 5-30 seconds. There may be about 1-20 cases per hour or not at all. There is no regularity. It also does not depend on the number of visitors or the time of day (in the morning there is little, in the evening the influx is the peak load). See screenshots, link at the end.

At the time of the problem, the SSH lossless ping does not drop the connection.

Site on Bitrix. There are big tables. When developing the code, it was taken into account that the site would be with high traffic and a large amount of content. Indexes are put in the database, the code and queries are optimized. Debugging does not show heavy requests or page generations. Hosted on a VPS with a special tariff for Bitrix. The software on the server has been optimized. 8 CPUs, 16 RAM, NVMe.

IMPORTANT
The problem appeared abruptly, not incrementally. Before the problem appeared, the pages opened very quickly with the same traffic. No changes were made to the code. The content hasn't grown much. I guess the problem is not in the code.

Tech support speaks in patterns. First, that there are a large number of connections (it should be so with high attendance?!), then, when they could not identify the problem, contact the developers, I am one of them.

For some reason I tried to increase the resources of the VM by 2 times. Connected high-speed channel up to 500mb/s. After that, according to the hoster, there was a DDoS attack, they switched to a secure channel with an IP change.

Screenshots at the link below. I will provide the required information upon request.
https://disk.yandex.ru/d/D1E8-RismSYXMw

Please help me figure out the problem. I would be VERY grateful $

update 04/13/2022: new screenshots added