Employee

Look at the visitors option in cPanel when this is happening. Sometimes it helps you track down a file that is being accessed when this is happening.

 

Also, go to CPU / Concurrent connection usage, click snapshots, then click a date and pick a few times. It shows processes that were running when cPanel noticed an overload.

 

It's possible neither of these will help, but I've tracked down silly issues like a poorly written theme accessing a file several times a minute if you set the logo to a file that doesn't exist, or that a backup plugin was running every time there was a resources event for example.