Unknown source of high number of connections
Sounds like a hacker.
Based on your graphs, I suggest that max_connections = 4000 is unreasonably high.  It looks like 20 might be reasonable.
You might want to set max_user_connections to some reasonable value (instead of 0 for &quot;unlimited&quot;).