You may find the atop package useful for this. It's like a recording version of htop. You can review historical loads after something has happened and see what the cause was.
I mentioned it in another post with some shortcut tips, and a link to a larger guide.