Hey there. I know this post is pretty old, but wanted to share some info in case it helps (hopefully you've already solved it).

3 million in seconds definitely doesn't seem like normal usage so that could be a DDoS attack. Whenever you see something like that happening, you can enable Attack Mode. It will challenge all visitors with a verification screen while allowing legitimate users through. It's free and requests blocked by it don't count toward your usage.

You can also investigate traffic in your dashboard to see what's hitting your site. Look for patterns in user agents, IP addresses, or specific routes being targeted.

For protection going forward, you can set up with spend limits and consider adding custom firewall rules to block specific bad actors.

For spikes in legitimate traffic, there's also a new Flat Rate CDN option that gives you a fixed monthly price. It covers traffic spikes for CDN Requests, Fast Data Transfer, Blob Data Transfer, and Observability events generated by CDN requests to prevent surprise bills.

https://vercel.com/blog/introducing-flat-rate-cdn