And I does not looks like a DDoS either, this amount of connections is quite normal for mid-sized apps, and connections can be kept open in case you app is slow, making your stats higher than it actually should be.

Btw, two servers plus a bit of architecture simplification solves this and cut the costs down to ~$400 or less.