HEY!! GUYS! THANK YOU SO MUCH!
I hadn’t thought that CVs could be generated by ANY request in to the web server. That was the disconnect in my brain as to why I couldn’t figure this out. I honestly should have known better but a big thank you for helping with that!
I installed fusion reactor as you said and sure enough, the web server was getting spammed from an IP in the UK. It wasn’t big enough for me to have noticed; however, one IIS IP ban later and no more hundreds of CVs being generated per minute. So that part is SOLVED!
I’m still wondering how to purge expired CVs from the database since Lucee doesn’t have the option in the Administrator like Coldfusion did.