All umami instances have been infected with a persisting crypto miner. Umami was affected by the next.js CVE but quietly released a fix, so most of their users missed it
Yup, umami was the culprit in my case. Quick update and it’s all running smooth again.