Never mind. I found the root cause of the issue. We have 7~8 lambda functions in total. Stopping the trigger of one lambda function also triggers the system automatic generated $disconnect event for another websocket event processing lambda function. The bulk arrival of these $disconnect events in a very short time triggers the ten fold spike of connections to MongoDB (from another websocket event processing lambda function).