Do you have anything in place for detecting and mitigating DOS attacks? I wonder if you were to grep the logs by IP address you'd see the offending IP addresses. Though if you're using a load balancer or some other kind of proxy and don't have IP address forwarding configured, all requests might come through as the same IP address.
some data got duplicated in random tables that shouldn’t be
I'd also check that there's plenty of disk space spare, given that the log files are so large, as I've seen environments start to behave unusually once disk space has ran out, including SSH locking up.

