Monitoring CPU is usually the domain of a SysView/Omegamon, but NetMaster can help in determining if things are out of the norm.
Check performance data within the product (shortcut is /PERF).
Baselining can be used to get a feel what is normal and what is not.
Review Stack Network Interfaces, Stack IP Connections, Address Spaces, Stack IP, TCP, and UDP, potentially even CSM - if it is being monitored - to see if there are any outliers.
There are many drill down capabilities showing hourly, daily, and weekly information.
For example, Stack IP Connections provides a simple number of Total connections.
It would be easy to see if there's been an increase in total number of connections and go from there.