I summed CPU time by user agent for 7 days: 63% went to clients that never load a second page

Seven days of nginx logs, three awk passes, and the bucket that ate 63.4% of backend time. Plus the two blocking attempts that measured almost nothing.