I saw this and wondered what everyone here thought:
The load average values should be within 75% of the number of CPUs. If a server has 4 CPUs, then 75% of 4 is 3. The load average values should not exceed 3 in that case. As the load averages approach the number of CPUs, then the CPU load is full.
If it is PHP-FPM which is consuming CPU cycles then Virtualmin lets you tweak the amount that each individual virtual server can consume. Go to Virtualmin → Web Configuration → PHP Options and then reduce or increase the value of PHP server sub-processes as appropriate.
If a particular domain / virtual server is consuming more CPU cycles than it should, change this value to a low number (like 2 for a misbehaving website) and your server will then have more spare capacity to deal with spikes.