Are you sure they are separate issues? If those toll bypass call/hack attempts are taking up licenses on your expressway (which you've clearly stated), they are connecting to something if only for a brief period of time, and clearly you have rules that are pretty open - if those "calls" are getting to the MCU before failing, they would indeed increase CPU load.
WRT to that other problem - did you try what I suggested? If you're still having the problems your search rules need work - you need to shut down the inbound access and only allow very specific URI patterns that match your environment. If you do that, you will probably end that problem in just a matter of minutes.
