Hello,

This sounds like a command is being executed which causes the issue for you.
There are a few things that I would recommend checking:

• Check the list of last logged in users. You can do that with this command:

last

The output will look like this:

root     pts/0        USER_IP     Fri Apr 24 15:11   still logged in
root     pts/0        USER_IP     Thu Apr 23 17:23 - 20:49  (03:26)
root     pts/0        USER_IP     Wed Apr 22 16:25 - 20:12  (03:47)
root     pts/0        USER_IP     Wed Apr 22 08:40 - 11:19  (02:39)

That way you will be able to tell if someone from anther IP address is accessing your Droplet.

• Check the last commands that were executed on the Droplet:

history

That way you will be able to see which command caused the problem

• Enable backups for your Droplet, that way you will be able to restore to a working backup rather than starting from scratch every time there is a problem

• Configure your firewall so that you could restrict some of the access to your Droplet. You can take a look at this tutorial here on how to do that:

https://www.digitalocean.com/community/tutorials/how-to-set-up-a-firewall-with-ufw-on-ubuntu-18-04

• Use only SSH Key-based authentication rather than passwords

Let me know how it goes!
Regards,
Bobby