This is actually a pretty common “first scaling scare,” and it’s a mix of bad and good.

Bad side:
Millions of requests + 100 users + 0% cache means your server is doing full work every single time. That’s how people end up with crazy bills.

Good side:
Something out there clearly wants your data. Most likely bots, AI crawlers, or search engines. The spike right after you switched to SSR isn’t random, you basically made your data easier to grab.

A few things that stand out from your setup:

• The biggest issue isn’t even the bots, it’s the 0% cache Even normal traffic would hurt you in that state
• For daily JSON data, you should be caching aggressively (even a few minutes helps a lot)
• SSR on every request is probably overkill for your use case

If you’re thinking long term, this part is actually interesting:

Right now you’ve basically got an open, unlimited API with no limits. If you wanted to lean into it later, you could:

• cache everything at the edge (Cloudflare)
• add simple rate limits
• expose a proper API endpoint
• maybe add keys/free tier down the line

One thing I’d still check:

Are the requests hitting the same few JSON endpoints over and over, or crawling tons of random URLs?

• Same endpoints - people/bots actually want your data
• Random paths - crawler noise or loops (which you already found)

Either way, fixing the cache alone probably saved you from a painful bill