Google bot crawl rate is every 2 seconds and it creates about 1.0-1.5 CPU load (average of 1 min) on a KVM host and a VM(web server) until the bot stops around 4AM. If you see the graph, there is not much traffic outgoing through Firewall's WAN interface RE0, less than 1Mbps most of the time. However when you see the graph of a web server's virtual BR0 interface, it is about 80Mbps most of the time(VM's outgoing interface).
I assume that bot traffic caused high CPU utilization but I don't understand how web server traffic is generated that much (80Mbps) and there is not much traffic on WAN interface. Feels like I made something wrong on the VM setting. Any help would be appreciated.