Discourse overloaded real traffic or DDOS? 100% CPU usage despite of decent traffic and high specs server

try
netstat -ntu|awk '{print $5}'|cut -d: -f1 -s|sort|uniq -c|sort -nk1 -r
and compare with your online users