asm practices for CPU/ memory tuning

You may see an increase in CPU resource consumption after adding brute force/web scraping or DoS profile protection. Memory is consumed for tracking sessions, clients, and users so it will be proportional to the number of concurrent clients in your application. What happens during an attack will depend on if you are using count-based mitigation (connections) or rate-based mitigation (cap connections or transactions from a specific IP address or for a specific URL). Either way, if you're getting hammered by bots, you will detect an increase in CPU during the attack.