Selfhosted

Two things to consider - check out Pressable or another dedicated WP Host. If you're over the price for shared hosting, they're competitive with Dedicated/VPS + addon backup solutions. They have a ton of caching built in, plus hourly backups. But it's not for everyone.

One thing with the CDN considerations - where's your audience? Local like in or around one city? Or local as in one country. The wider the reach, the more a CDN is beneficial. It doesn't sound like it would help a lot. But it can also offload storage and the load of serving those requests.

To add what others said - Caching. You could do it on site and add Cloudflare on top of it. But you'll probably want to add a few custom rules to cloudflare like Geo-restriction + no caching on /wp-admin/. Cloudflare also has anti-bot tech.

Beyond that, I've been waging a war on bots for a number of reasons. One of the easiest ways to block them is to block ASNs if you use Cloudflare. If AI or bot traffic is a problem, read on. If not, don't worry about any of this.

If you want to block IP ranges yourself in Apache/nginx, your firewall, or your VPS provider's firewall, start with looking up IPs in Amazon and Microsoft's IPs (Like as listed here: https://ipinfo.io/AS16509) and start with the largest ranges.

With one line you can block 4.1M IPs from Amazon: 3.0.0.0/10 - start with these and go down to /16 and in a few hours you'll kill access to tens of millions of bots.

You can also block by user agents.

I'm happy to share some Apache Rules/files if it would be helpful.

My theory on blocking is simple: I try to block as much as possible as far from the application layer at possible. It costs the most, in computational resources you pay for, to add a firewall inside of WordPress, like Wordfence. It also protects you the least. Blocking at Cloudflare and the VPS's providers firewalls would be most efficient, followed by the firewall on the VPS, followed by an Apache/Nginx firewall, and then your application layer - WordPress. If you're problems are mostly bot traffic, you want block as much bad traffic as possible without false positives.

OpenLiteSpeed https://openlitespeed.org/

Host-specific guides (but no hetzner):

https://docs.litespeedtech.com/cloud/images/wordpress/

Very easy, robust, fast.

You can def roll your own sever and solution, but WordPress needs a lot of help. As other commentors said, you need to bypass both the database and PHP as much as possible, via caching.

While a simple redis or valkey store solves that, you're relying on some integration thru the php layer to make it happen, usually some plugin.

Serving files or otherwise caching directly thru the webserver is gonna make it faaaaast.

Then there's the question of database writes. Who is writing to your database, where, and how often?

Edit: I see you have editors updating content 1-2x per hour. They should rewrite caches hot on each update so they're the only ones paying the db latency cost.

Use a page caching plugin that writes HTML files to disk. I don't do a lot with WordPress any more, but my preferred one was WP Super Cache. Then, you need to configure Nginx to serve pages directly from disk if they exist. By doing this, page loads don't need to hit PHP and you effectively get the same performance as if it were a static site.

See how you go with just that, with no other changes. You shouldn't need FastCGI caching. If you can get most page loads hitting static HTML files, you likely won't need any other optimizations.

One issue you'll hit is if there's any highly dynamic content on the page, that's generated on the server. You'll need to use JavaScript to load any dynamic bits. Normal article editing is fine, as WordPress will automatically clear related caches on publish.

For the server, make sure it's located near the region where the majority of your users are located. For 200k monthly hits, I doubt you'd need a machine as powerful as the Hetzner one you mentioned. What are you using currently?