My Account team actual provide a solution. Thought I would pass along here.
Take a look at this: Restrict performance monitoring access (servicenow.com)
Use the glide.security.diag_txns_acl property to control stats.do, threads.do, thread_pool_stats, and replication.do access from an unauthenticated connection.
When you set this property to true, the glide.security.diag_txns_acl property only allows access to the following by the administrator account:
