You need to check the actual access logs, such as web, SSH, etc., and if you can access it, the MySQL log, too. That will show you what is possibly hitting the site at that time and let you differentiate between a huge unexplained web traffic spike from a bot and something that is happening in WordPress or the theme itself, or on the server.
If it’s a shared cloud server, you may be seeing spillover from another account, depending on how the accounts are configured.