Wordpress Malware Cleanup and Optimization

So for the past few months I have been hounding my developers to look at my site because server resources kept intermittently maxing out. The site would produce error pages and not load for customers, and then return to normal albeit a bit slow 5 minutes later. Every time something like this happens it means we are under attack. For weeks they said it was fine and nothing is wrong. 3 days ago the site disappeared. Entirely gone. Going to the URL brought you to a wordpress signup page. I restored from a backup and it was working again. Broken and gone again within 24hrs. The database was getting overloaded with slow queries and shutting down. Last night I dove in and removed some stuff that may have been taxing the server and did some cleanup that got the site working again. After what appears to be a caching issue that displayed 404 pages everywhere I once again have the site working. That leads me to where we are today. After hours of cleanup, updating, optimizing, I know without a shadow of a doubt there are malicious files on the site. How do I know this? The server CPU usage is still intermittently maxing out, and there are still slow database queries. The security and other vital caching plugins, wp-admin change URL, were off when I was finally able to access the site. ALSO the biggest red flag- a fake credit card checkout form that only shows up every few refreshes. We use an entirely 3rd party system for entering credit card info. There is no form on our site for this, it is only entered on authorize.net for customer safety. This is to prevent anybody's info from being compromised in the case of the site being compromised. Our security involves hostinger scans, and a paid database cleanup, wordfence premium, and cleantalk. There is also custom code for detecting intruders, quarantining them, etc. Somehow all of these fortified measures were bypassed. But not a single system, wordfence, hostinger, cleantalk, etc says it can detect a single piece of malicious code. I need a real expert to wipe it out COMPLETELY and let me know how to fix it once and for all. I am sick of the constant attacks. We are ALWAYS under attack. I need this done NOW. We are supposed to be running a sale and these continued attacks, crashes, and problems are ruining my time and my customer's experience. apparently most developers can't or won't handle a problem before it becomes a larger issue. For the right person this should be relatively quick and easy. Don't waste my time.