The traffic spike goes up to 6 hits /sec for up to 20-30 mins
if you consider 6 hits per second a spike you need a reality check. I would consider 6 hits per second a zero load situation.
During the spikes the response time gets really bad and goes up to more than two minutes
for the page to be served
Crappy programming or a very bad server, smaller than my mobile phone.
I have a 1GB RAM server hosted on a cloud with CPU spiking. Should I buy more CPU or
Figure that out. I would basically start telling you that there is no way it should take minutes to respond on something that has 6 hits per second to start with - very unusual circumstances notwithstanding. Maybe you miss an index and force MySQL to do table scans all the time. I personally would be very concerned if I could not handle 6 requests per second on one core on a virtual machine, pretty much regardless how big it is. Or - brutally speaking: I would expect my phone to do that. Last time I did a larger website we considered 30ms to be the processing time limit. That would mean more than 30 requests per second per core.
Otherwise you need to find out - if your CPU really spikes then you need more CPU if RAM would be not sufficient and it would go to disc, then the CPU would not be fully busy. But again, this sounds like "my car only goes 30km/h, please tell me what to tune next" while the car SHOULD go a lot faster. This really smells a lot more like bad programming to start.