No there’s nothing wrong with CloudFlare, this looks to be solely inside of the server. If I had to guess, I’d say Apache Prefork receiving an attack and causing it to run out of child processes, therefore timing out. You mentioned xmlrpc so that makes me think Wordpress under an xmlrpc attack, which can still run the web server out of child procs especially with prefork mpm, even if it’s just to return a 404.

If I’m right and you’re on Apache, try changing to event mpm and php-fpm. I don’t think this guide is going to work step by step, but it’s at least a good starting point. For example it uses PHP 5 and you may be on PHP 7, so adjustments may need to be made.

https://medium.com/@pushpendrachauhan/how-migrating-apache-mpm-from-prefork-to-event-based-using-php-fpm-saved-our-day-8a6e371d94fd

Jarland

I’m sorry, I do not have a step by step guide for changing your stack that applies to all situations. If you post a full listing of your stack, from OS distribution to software versions, someone may be able to offer more clear advice on how to adjust that specific stack. If you are unable to adjust your software stack to meet the needs of your website, you may need to seek assistance from a third party that can help you to manage the server.

If you need immediate assistance to bring your web server configuration up to par, these are some examples of providers that offer management services:
https://www.rack911.com/
https://www.24x7serversupport.com/
https://bobcares.com/emergency-server-support/