Its quite simple.
First and foremost you must identify what company is doing the scrubbing. If its hardware from example ArborNetworks, Voxility or whatever. That already narrows it way down.
In many cases, you can do many tcpdumps etc and you wont find it. I had the exact same issue using ArborNetworks, which ratelimited the master servers. The DDOS attack might even exhaust your CS:GO server with A2S requests, and your CS:GO server then needs to reload to clear out new connections. I´ve had this issue over multiple instances. Add me on discord and we can have a talk about it
