If none of the sites you are hosting are hacked and the server configuration is right, then the next explanation is that some of your websites are constantly hitting with requests from bot networks.
I had the same problem on one of my clients. Everything was fine server wise but the php-fpm was 100%. We put his site behind cloudflare, monitor the traffic from which countries and IPs had constantly too many requests to justify as a human being and block these countries and IPs.
You should check the access logs and see if specific IPs are constantly hitting your server with requests. Then block em.