Any protection against DoS in place, like WAF? Public services on EC2 are very prone to this kind of exposure. Maybe some fail2ban?