If we hit a lot of random sub folder URLs (that should all 404), would that trigger the webserver to check the drive to see if the file exists and skip the cache?
The DDoS scenario would be doing GET requests of random nonexistent filenames. You could change the name at every step so that the check for a negative dentry is never a cache hit.
Also the page/buffer cache would probably cache the FAT direntries so probably not a huge issue here.
It seems necessary that the blocks storing the directory entries are cached too. Otherwise every non-existent lookup (that doesn't hit a negative dentry) would hit disk, each separately.
So yeah, the page cache is keyed by file, but the system should still cache the directory structure.