Things I would check on server side:
- is CPU running high
- is memory running low / lots of swapping / memory leaks
- high disk interaction, e.g. lots of logging happening in the background, too many open file handles
- maybe web server needs some fine tuning regarding instance creation / spawning, which also leads to next point ...
On load balancer / firewall side:
- unusual high traffic -> (D)DOS attack