Squidex is MIT license and has reasonable pricing for their cloud offering, also has graphQL support and more feature rich.
That way if you see a traffic spike or a DDoS attack, it's directed only towards static files on S3 and you can let Amazon take care of it. I don't want to be too critical of how people have things set up because I'm sure they have their reasons, but that said I don't think a page request on your site should map directly to an API request to the CMS.