I’d say 8–9 times out of 10 it’s misconfiguration or inefficient code rather than a real attack.High CPU usage could just be some internal issue like bad plugin, heavy quiries, cron jobs looping... traffic spike from benign bots. A lot of factors.
Start from inside your stack then work through assuming it’s external.
If everything is fine on your end, then yeah, reach out to your hosting support and have them check what's spiking the CPU. They should usually see the exact processes or request pattern causing it. Usually.