There was a second incident today noon. The DBMS committed 116 GB RAM, which it does not have, so swapped heavily. The load average went to 47 in a (physical) machine with 24 CPU threads. Stated just past 11:30 was finished by 12:00. The monitoring graphs look like somebody has restarted the server (haven't restarted even the DB server).
I was ready this time, Show origin of SQL calls was set to Show full stack trace and the slow queries were written to a file. The part between 11:30 and 12:00 is attached.
You'll see that three databases are involved, all are Moodle DBs. The first one, xyzfmoodle, is the suspected one. I have logs of a teacher who was transferring quizzed through the sharing cart. She has been doing it since 11:19 dozens of times. According to Moodle logs none has taken more than 1 second each. So could be a red herring.
More likely are these tasks running now:

and the Ad hoc tasts show:

How can I find out where they come from and why still unfinished although the DB was released? Or, had the DB dropped everything and restarted?
Notice that the xyzfmoodle is the database once crashed with 3 million duplicate questions. After much cleaning it has close to 600'000 question instances now.

