Monitor network traffic per client
MariaDB has a user statistics plugin that provides a breakdown per user.
It can be enabled dynamicly:
SET GLOBAL userstat=1;

And examined:
SELECT * FROM INFORMATION_SCHEMA.USER_STATISTICS\G

It seems like such a increase is potentially a brute force attempt or some abnormal use. I'd look at the SHOW PROCESSLIST and see if the queries being run are extraordinary and/or you'll probably see there a client with more connections than expected.