How can I find security hole in my wordpress site?

The Symptoms you mentioned in your question and comment indicates that you might have compromised / nulled plugin or theme that deployed some sort of shell bomb. Its possible that there might be multiple malicious files in your main domain, add-on domains and subdomains. Its also possible that your default core wordpress files might also have been infected by malicious code. This type of behavior is quite common.

Your best bet here is to:

1. Check the modified timestamps of files and folders. Find most
   recently modified files. Start by collecting samples from files with .suspected extension. The line in your htaccess are basically telling apache to treat .suspected files as PHP file which means they are executable. So these are not quarantined files these are active malwares.
2. Try to identify malware signature. This can be a difficult task but
   you should be looking for encrypted code first. Hackers usually use
   eval and base64_decode to decrypt encrypted code. Also check for file_get_contents
3. When you identify one or two signatures start hunting them with the
   acquired pattern.
4. Another way is to download entire wordpress installation, open it in
   text editor and use find in all files to find malicious code. In this case I will recommend Notepade++ but you can use any good text editor.
5. Now after checking each directory, upload your website.
6. Install some security plugin to scan your installation against
   malwares and compare core files against their respective
   repositories to find any possible modifications.

Its also possible that after all this there might be some left over pieces of malware that can make your site vulnerable to remote file uploads, remote file inclusion or hidden administrative users which can be very hard to detect.

Now here I would recommend using antivirus to scan for malicious files but these malicious codes can easily evade most of the antivirus. So I would recommend you to find an expert to do this for you.

You should also update your wordpress installation, plugins, themes to their latest versions and change passwords of control panel account, database and wordpress users.

Lastly at best hacker can only infect the server on which the website is present to possibly send mass mails, run crypto currency miners, stealing user information, hosting phishing pages but It can not affect your google search console account.

I hope this will help you. Best of luck.