I've already set up the modsecurity firewall, fail2ban and set up the reverse proxy with ngix.
Is it possible that there is some cron job doing checks on all sites? On plesk, however, I have already reduced the cron processes to avoid continuous slowdowns.
Are there any other "hidden" ones?