Discourse overloaded real traffic or DDOS? 100% CPU usage despite of decent traffic and high specs server

As I tried to explain, netstat works on a different level. There is no nginx config in the world that will make netstat show real IP’s if your forum is behind Cloudflare.

Edit: I see you changed “not” into “now” so your post makes much more sense now.