There are many IPs from two autonomous systems crawling pages using fake user agents such as Safari/537.36, Chrome/27.0.1453.93, Chrome/37.0.2062.124, Chrome/35.0.2309.372. I have blocked the two IP ranges.
The php-fpm setting
pm.max_children = 5
pm.start_servers = 2
pm.min_spare_servers = 1
pm.max_spare_servers = 3
seemed un-configured and reserved too few processes. Changed to:
pm = dynamic
pm.max_children = 32
pm.start_servers = 8
pm.min_spare_servers = 4
pm.max_spare_servers = 8
pm.status_path = /php-fpm-status