Is it DDos or a virus breaking?

Question

System administration

Good afternoon!
At home, 2 Internet channels were wired, one under the server, the other for home use.
I installed MikroTik RB941-2nD-TC for the house instead of the old asus rt-n12, and began to notice that sometimes the speed sags, and the CPU load on MikroTik is always 100% (Photo below). All connections are breaking on 4444> 53 port.
Right now I compared the connections on another router (RB2011UAS-RM) where there are servers, there are no such connections, and the CPU usage is 40-50%, although there are more rules in the firewall.
Could it be DDos, what kind of virus to break, or does it just not pull out?

Ps Previously, there were servers on ip which is now used for the home.

Answer 1

This uses your router as a DNS server.
Known issue.
Add a firewall rule
/ip firewall filter add chain=input action=drop in-interface=WAN
WAN to the end of the list and change it to your incoming port.

Answer 2

firewall 53 udp\tcp from the outside world. This is a well-known Mikrotik joke - if you turn on the dns server, then it is available from everywhere;)

Answer 3

This is you DDoS'ite. reply is much larger than the input, plus if it happens on port 53 - a classic of increasing the power of UDP flooding through carelessly configured DNS and firewall.
Reconfigure your firewall to an adequate mode, everything that is not explicitly allowed is prohibited.

Answer 4

Add rules to the input chain(ether1 is the provider interface)
chain=input action=drop protocol=tcp in-interface=ether1 dst-port=53 log=no log-prefix=""
chain=input action=drop protocol=udp in -interface=ether1 dst-port=53 log=no log-prefix=""
I would also advise you to look at what is configured in NAT.
Is there a forwarding rule on port 4444 for the service?
I advise you to read the wiki