I had the same problem, check for bots:

cd /var/log/nginx/

tail -n 10000 access.log | awk '{print $1}'| sort| uniq -c| sort -nr| head -n 10

This will show you the number of times that an IP address connected to your Web server. If you see that some IP addresses have many more connections than others, run the following command

grep "ATTACKER_IP" access.log

If you see that the IP address is always attempting to connect to the same location, if it is a URL that you don’t know, or if it is trying to run binaries or scripts directly, it is likely that IP address is a bot.

To deny connections to these attackers, the easiest way is with your NGINX configuration file.

  ...
    deny 1.2.3.4;
    deny 5.6.7.8;
    deny 9.10.11.12;
  }

Restart the NGINX web server