The client makes a lot of ajax requests since it's so ajax heavy and there is no throttling on the concurrency. When 5-10 requests hit the server from the same client at the same time it is a "little" bit like a dos attack.
Any idea why that's pegging the CPU? My naive analysis would be that once the database has sent/stored the data, the server is just doing some light filtering/serialization and sending it off to the client. But obviously there's more going on if these requests (en masse) can get you to 100 load.
Shot in the dark: Is there some kind of sorting going on?