To tackle this, first get a list of Apache processes
# ps aux | grep httpd (or # ps aux | grep apache, depending on OS)
In that list identify the processes with the highest CPU usage. Then look into what the process is doing:
# strace -p <PID>
(<PID> = process ID)
The process will normally show some hints what domain is causing the high load.
Then look into the access_log and error_log file of that domain to identify what is causing the load. Normally it is either a bad bot or a brute force attack.