"Thank you for the security reminder. I will reach out to the owner to see if we can implement the necessary updates."
Would think that would be priority #1. For 2 cent advice, see * below.
"We currently have a firewall and Cloudflare in place, which should help ensure that our traffic remains secure."
If site began it's life behind CloudFlare then great. If it didn't, black hats already know it's IP address and they tend not to use FQDN.
MySQLTuner - offers suggestions ... not absolutes. At the top of MySQLTuner what does it say for
Maximum reached memory usage: (% of installed RAM)
Maximum possible memory usage: (% installed RAM)
Overall possible memory usage with other process is compatible with memory available
Slow queries:
Highest usage of available connections
Default connections is 151 and it is one of the variables tweaked upwards.
And yes, one can get diminishing returns on tweaks to DB config.
Is there a better tool or better adivce? Maybe Percona?
https://www.percona.com/blog/how-to-monitor-online-innodb-buffer-pool-resizing/
Deeper dive:
https://forums.percona.com/t/innodb-buffer-pool-size/4427/2
I did notice, also, that there was a table larger then the quiz tables ... that of mdl_log_store_standard_log. That's the "who done it" table and is involved even in quizzes as it records all users actions - might want to add that to the bottleneck investigations.
Mr. V has also pointed out the quizzes themselves.
Will say this ... over the years, have observed Moodle is a memory hog - period. And it's primarily DB. I realize that computer sci/server folks don't like to hear it, but 'better to have more than enough and not enough' when it comes to memory.
* So since the server is to be migrated from CentOS 7, the place and time to increase that memory is on new server is now. I wouldn't do an upgrade in place ... there is a tool for that offered by AlmaLinux folks but it's only to AlmaLinux 8 ... and there is an AlmaLinux 9 out now to keep pace with RH.
Customers also don't like to hear more memory either as that tends to mean more cost.
My 2 cents!
'SoS', Ken