When I open current CPU processes I see this process in several lines there. Usually it is not using almost anything from CPU but sometimes using 50 %. This I don't understand.
Shouldn't that process be in just one line as this looks like he is running multiple .
Well, if it kills your server because there are many accesses (see netstat), I would check the logs (check them anyway), because someone might try to brute force logins to your sensitive information (if you or your customer runs an SSL site). If not, I would check the apache error logs anyway.