Determine whether this is activity for services you are providing from this host. If not, investigate whether it is unauthorized and should be removed. If it is legit activity, check whether performance is acceptable to you.
Be comprehensive in your investigation. PHP usually mean web apps, review the access logs. Look at log files in general, especially user authentication. Profile the applications to see where they are using CPU, either a PHP specific profiler or system wide with
perf record. Compare applications installed with their last known good backup, look for unauthorized (or poorly documented) changes.
CPU increasing from 5% to 40% probably is a notable event. However, you must investigate what runs on this box. There is no way we know what apps you run, let alone what is good performance or expected load for them.