Thanks will look on it.

Here is what AI thinks:

What is most likely happening:

PHP session is started for every anonymous visitor/bot request.
Bots often do not store cookies.
Without session cookie persistence, every request creates a brand new sess_* file.
If the site is crawled aggressively (Cloudflare, Ahrefs, Semrush, MJ12bot, AI crawlers, vulnerability scanners, etc.), thousands of sessions can be generated very quickly.

The session content you posted actually supports this theory:

item_ids_i_num_premium_views
alert-related keys
empty form arrays

This looks like frontend visitor state, not some runaway memory leak.

Main issue is usually one of these:

session_start() is called globally on every request.
Sessions are started for guests even when not needed.
PHP garbage collection is ineffective or disabled.
Bots create endless fresh sessions because they do not keep cookies.
Session lifetime (gc_maxlifetime) is too high.
Cleanup probability (session.gc_probability) is too low.
Using filesystem sessions on high traffic sites.

Testing on “multiple VPS servers” does not fully prove anything because:

same PHP configuration may have been copied,
same traffic/bots hit all servers,
same Cloudflare/WAF/crawler environment,
same Osclass/plugin behavior.

A VPS with 48 GB RAM does not protect against filesystem overload if millions of tiny session files are created.

What should actually be investigated:

How often session_start() is called.
Which requests create sessions.
Whether sessions are created for bots.
Whether plugins unnecessarily initialize sessions.
PHP settings:
session.gc_probability
session.gc_divisor
session.gc_maxlifetime
session.save_path
Number of requests from bots without cookies.
Whether Cloudflare bypasses cache and hits PHP for every request.

Best solution is usually:

do not start sessions for guests unless required,
skip sessions for known bots/crawlers,
move sessions to Redis/Memcached,
reduce session lifetime,
add aggressive cleanup cron,
cache public pages properly.

Answer:

issue is real,
not necessarily hosting issue,
but also not proof that Osclass core is broken,
most likely interaction between bot traffic + PHP session handling + session initialization logic.

There is possiblity, but you have not added url nor screenshot or function you are using, so it's quite hard to help you

Would it be possible to transform the field where you enter the city into a simple text field and not have all the cities loaded when you choose the region?

How can I make the phone number field visible only to the author of the publication?