Tracing Cause Of Server Load Spike *after* Reboot

I have a cpanel, centos server that had to be rebooted due to the high load spike. I was unable to ssh in nor enter whm prior to the reboot so my only option was of course to reboot the server.

Now, I'm trying to trace the cause of the spike. RTG graphs show no indication of a ddos attack.

Inside whm, CPU/Memory/MySQL Usage shows no reds nor yellow warnings either except red for gzip (backup process) at 19% CPU. I doubt this is the cause.

This is from /var/log/messages of the logs slightly before and after the reboot.

Code:
Apr 9 13:31:49 server pure-ftpd: (?@70.250.201.162) [INFO] Logout.
Apr 9 13:32:05 server pure-ftpd: (?@xxx.xxx.85.3) [INFO] New connection from xxx.xxx.85.3
Apr 9 13:32:28 server pure-ftpd: (?@xxx.xxx.85.3) [INFO] New connection from xxx.xxx.85.3 .......