I just found the culprit…
In nginx access logs, after making a cat dump and waiting for similarities, I literally found a large block of thousands of the same request from the same IP which returned error code 429
I have now blacklisted that IP, so I hope it won’t happen again…