How do I troubleshoot slow throughput on an old 200B?

[caos]

I've inherited two 200B firewalls, setup in an active/passive HA with two VDOMs, one VDOM more or less empty and the other one is shared by half a dozen customers. Running v5.2.13, God only knows when it was last updated.  

All support is long gone. 

Some months ago users started complaining that performance had degraded. I'm not aware of any configuration changes, but somebody else might have done anything without logging it. 

I's connected to the Internet using a 1 Gbit line, but Speedtest only reaches up to 48 Mbit down and 23 up, sometimes going as low as 9 Mbit down. 

I've recreated this issue at 4:00 AM, with virtually no traffic at all. I can see CPU is going very high during the tests. 

Can anyone direct me to steps to take for a systematic analysis and resolution?

So far, I've only found sites where people say "Have you checked..." or "Try to...", but more or less randomly trying common solutions takes too much time without guaranteeing a solution. 

Btw, it's scheduled to be replaced, but until then we need to make the customers happy again.