Strongly advise installing mysqltuner regardless.
The 'top' screen shot you've shared didn't show the top of that screen where one sees total memory of server, how much memory is being used, how much free and now much buffered ... and ***the second line below that one that shows 'SWAP' space ... space available for swap, how much is being used, etc.
A server that is an all-in-one ... meaning contains the apache server *and* the database server not only has to have enough apache processes to handle incoming request, but also the resulting DB queries.
A DB server that is using a lot of SWAP space will be slow - SWAP is disk io.
Moodle will do one or the other ... DB or files. If set to files, it won't do DB. While truncating the table for sessions will reduce the size of the DB if the server is using files for sessions, truncating won't fix this.
Moodle has a cron job and also task ... one of the task is to clean up stale sessions ... it removes files.
For the du command to all of sudden say it can't find a file is rare .... don't think I've ever seen that in many years of running Moodles.
When did du report that ... at the very beginning?
Check the task for cleaning up sessions ... could be you did the du at the same time the task/cron job to clean up stale sessions kicked in.
Administrator level users have larger session files ... a session file is like a 'permissions' file for a user ... mapping out what a user logged onto Moodle can do and not do.
'spirit of sharing', Ken