If you eliminate 3 sites and find the one responsible you could focus your
search drastically.
Currently there are too many moving parts that you are looking at: PHP, MySQL,
Cloudflare, 4 installs of WP.
I think it might be easier to apply changes to one install and watch the behaviour of the server afterwards while monitoring only one site instead of four.
