I find that it is “a very good thing” to capture historical data like this in SQL databases ... and I usually use good ol’ SQLite for this.   (It is a great way to produce “a flat disk file” that you can query.)

However, in your case, I agree that you should look at existing log-analysis programs first.   “Do Not Do A Thing Already Done.”

My “gut instinct” with regard to this particular case is:   do you have a load-balancer?   Is there anything, hardware-wise, sitting in front of these servers and apportioning the traffic between them?   If so, it is very likely that it is dispatching the traffic in an unfair way.