You take the load value from top and divide it by the number of cores the VPS has access to. So if you have a load of 4.0 and your VPS was provisioned with 4 vCores, then you have a load value of 1.0 which is 100%. This means you'll have processes waiting around for CPU time although I think it would be more likely you'd experience CPU steal time from bad neighbors taking CPU cycles away from you as most hosts are over provisioned to maximize return.
But assuming you don't have any bad neighbors then depending on the size of your site the next thing I'd suggest you look at would be attacks on your login pages. There isn't any logs for such a thing by default but bots have been pounding my login pages pretty regularly and I wasn't aware of this until I installed Dragonbyte Security. A web application firewall from someone like Cloudflare would do wonders in these cases not only now but in the future as your site continues to grow.
Lastly, if you notice during your peak times your site is regularly slowing down despite everything else then sure feel free to upgrade. The problem I've found, is that many people run inefficient software, do not secure their webserver properly and generally speaking are not very good system administrators. This leads to upgrading things like memory, storage, etc only for them to be filled up or used again. The end result is the hackers are able to perform more brute force attempts per hour and consequently your logs which are recording this behavior can get even bigger before you run out of disk.
If you have those regular spikes, it would be helpful to know what time of day that is. Also, check to ensure you aren't running a bunch of crons at that moment. Do things like backups, email campaigns and daily cleanup crons during those low activity times.
