If you have a small userbase, you can do some simple crosschecks.
If you grep on the nginx log file for example for the mail
grep “/mail/” /var/log/nginx/access.log | cut -f1 -d " " | sort -u
a list of different ip addresses is generated.
If you have for example 5 users and you see hundreds of IP addresses, some investigation is needed.
The same for:
grep “/cloud/” /var/log/nginx/access.log | cut -f1 -d " " | sort -u
The “other” requests are visible by gripping on the logfile:
cat /var/log/nginx/access.log | grep -v “/cloud/” | grep -v “/mail/” | less
You’ll probably see a lot of wordpress/phpmyadmin related strange queries and the queries for your websites. But that’s not causing any high load of php-fpm (except if you’re running this kind of sites under the same uid