Our API endpoint was being abused by a malicious user which send about 20 req/s, as php-fpm uses a pool of workers this easily over burdens them and also gives the server a constant 100% CPU load.
Applying a rate limit succesfully negates this issue.