It's difficult to fix and not without changes in the code. Most solutions involve fixing those heavy SQL. Tuning them, caching them in redis or memcached or refactor the whole process from scratch.
Thinking on the DDoS part, implement short circuits so reaching those queries must follow a session pattern. It doesn't stop it but you force those script kiddies to make real connections. If they are anonymous then all the heavy queries should be cached due to lack of custom vars. If not, it's a matter of identifying users and banning them automatically.
Maybe it could be an issue with the level range. I feel the game well balanced with my char at 150 but same mobs destroys or two shots people at +300 looking at some videos.