Additionally, be sure to check how your script behaves with SPAs and the browser history API. You seem to be binding to the browser history as-is, and might be firing lots of non-page view events.

It's not just a theoretical case, I saw this for many customers with Panelbear. Many JS frameworks use the history API in ways you may not be considering.

That's why I would recommend de-duplicating events on the client-side before sending them to your ingestion pipeline.

But that is DDoS matters aside.