I've just seen a POST /ajax/vrequest HTTP/1.1 that's supposed to load the timeout until the captcha and that was answered with a 403 from your server.
Don't you have any logs? I bet you find tons of 403 and 404 in there.
Or this one:
11:39:02.401193 [...] > 198.154.102.18.80: P [bad tcp cksum 5f97!] 2519:3176(657) ack 2497 win 16603 (DF) (ttl 127, id 57636, len 697)
[...]
GET /captcha?c=view&uid=[...] HTTP/1.1
Host: btcclicks.com
Connection: keep-alive
[...]
11:39:02.623465 198.154.102.18.80 > [...]: . [tcp sum ok] 2497:2497(0) ack 3176 win 172 (DF) (ttl 54, id 27013, len 40)
[...]
11:39:14.699238 198.154.102.18.80 > [...]: . 2497:3949(1452) ack 3176 win 172 (DF) (ttl 54, id 47128, len 1492)
[...]
HTTP/1.1 200 OK
[...]
12 seconds to load the captcha.
11:43:03.216432 [...] > 198.154.102.18.80: P [bad tcp cksum f3ee!] 1577:2267(690) ack 8451 win 16603 (DF) (ttl 127, id 8866, len 730)
[...]
GET /view?a=de62719500104a229d2106f835feeb03183fabb12ddbe46af1d409feab92f2ea HTTP/1.1
Host: btcclicks.com
Connection: keep-alive
[...]
11:43:03.399658 198.154.102.18.80 > [...]: . [tcp sum ok] 8451:8451(0) ack 2267 win 154 (DF)
[...]
11:43:03.436719 198.154.102.18.80 > [...]: . 8451:9903(1452) ack 2267 win 154 (DF) (ttl 54, id 49389, len 1492)
[...]
HTTP/1.1 404 Not Found
Server: nginx
Date: Sun, 07 Sep 2014 09:42:57 GMT
[...]
404 with timestamp from your server. (Your clock is off btw). The ad was not expired or anything. A reload worked fine.
And finally I managed to get "An error has occured" when solving the captcha. This didn't even cause any network traffic AFAICS.
I'm probably wasting 50% more time due to all these errors because I have to load ads over and over or solve captchas twice etc.
Not cool.
The 403/404 errors will happen due to a burst of multiple requests from the same IP address. As for the timeouts are they 502 or 505 errors?
Do the errors happen all the time regardless of the time of the day, or do they occur at a certain of the day? I'm not understanding how and why would you get timeouts when the servers is barely at 10% capacity whenever I check.
I've checked the logs against the last IP address you used to login into and it seems you are triggering the burst protection, is there anyone else on your network using the website?