Urgent Bot Traffic Mitigation targeting my WordPress website domain

My main domain is being hammered by unknown traffic that instantly drives CPU and RAM to 100 %, even though the exact same site runs smoothly on a different domain. I already have a standard firewall, a DDoS-protection service and manual IP blocking in place, plus I run the site on a VPS with CPGuard under Hostinger’s Cloud Enterprise plan, yet the abuse continues.

I need someone who can jump in right away, study real-time logs and analytics, pinpoint the source and pattern of this suspicious load, and then implement hard-hitting counter-measures. Think along the lines of fine-tuned Web Application Firewall rules, rate limiting, CDN-level shielding, smart bot filtering, Geo/IP throttling, or any proven technique you deem effective—so long as it stops the spike and keeps legitimate visitors unaffected.

Deliverables
• Clear diagnosis of how the bots are bypassing current defences
• Concrete changes or new tools deployed (e.g., WAF rules, CDN configuration, server tweaks)
• Post-fix stress test proving stable resource usage under simulated load
• Brief hand-over notes so I can monitor and adjust settings on my own

I’m looking to resolve this ASAP, so the faster you can demonstrate results, the better.