Hi Mark,
Just before I went into surgery yesterday, I got a fuller explanation from HostGator on what was going on with my site. It appears that the issue has now been resolved.
They found out that over 6,000 ajax requests were coming from my IP address. They wrote: "While you or another person with administrative access may not have been actively working on the site from your wp-admin panel, ajax requests such as this often occur in a loop, sending requests to the server over and over again, as long as the referral page remains open in a tab in a web browser. This is in fact one known issue with the Wordfence Security plugin. Consequently, I often advise customers to immediately close its configuration page once they are done making changes to it so that the ajax requesst don't continue to hit the server over and over again (otherwise it's best to use a security plugin that is less resource intensive)."
As it turns out, I had my WordFence options page open for HOURS at a time at various times during all of this. I had no idea at all that I could be causing the problem! I DID have other issues that I needed to address to bring my CPU usage down, and that seemed to fix things for a while. But at one point I was dealing with WordFence and looking at all its options, including doing quite a bit of analysis of the Live Traffic view, and I just never closed that page! So the spikes started happening again.
As of very early Friday morning, I have had no troubles with CPU usage, and I'm still running WordFence just fine. Somewhere along the line I learned that it would be advantageous to disable the Live Traffic View, so I did that. Without looking at the page of options, I think that I do still have the "automatic scheduled scans" enabled, because I got an email notice early today about needing to update a plugin. So that's fine.
I do, however, want to know if you can advise me further about the Firewall Rules settings. If my CPU usage is low, would it benefit me at all to use any of those settings, especially the one about fake Google crawlers? Obviously, I would want to get in and out of that page fairly quickly, so if there's something you can tell me to do, step by step, to make adjustments, that would be great!
Also, it seems like good advice to make your users aware that it's best to never keep the WordFence options page open for any length of time. As the HostGator Tech wrote: "I often advise customers to immediately close its configuration page once they are done making changes to it." Perhaps a notice directly on the options page stating that you need to close it as soon as possible to avoid CPU overload would be a good thing!
Regards and Thanks,
bwhughes