I am insufficiently skilled at MySQL to diagnose probable reasons for that, but think it is unlikely that it would be uniquely triggered by a botnet. Instead,

I am insufficiently skilled at MySQL to diagnose probable reasons for that, but think it is unlikely that it would be uniquely triggered by a botnet. Instead, I'm betting that it is a problem with the application (PHP, maybe?) which is opening one new connection per page view and failing to close it, either because the application is improperly coded or because the application might be dying due to lack of resources (caused by your traffic spike) and not clean up after itself in the event of death.