hostgator, scam or normal?

we have multiple business websites that have been hosted on hostgator for 8 years.  not much has changed they are mainly informational sites, no eCommerce (unless they link/navigate off our site to paypal to book a reservation), just standard joomla 2.5 sites, with one integrated "contact us" form they can fill out.  we have a shared host and about 6 months ago supposedly started having a security issue for which they told us we needed to start monitoring (paying for them to "fix"...or could it be something they initiated so we pay them a higher monthly fee?).......we paid the fee/ransom and now today they are saying joomla is causing cpu issues and we should switch to a dedicated server.  they can never tell us what the exact problem is just sent us a suggestion for a smooth running joomla site.  they also said there is a "security token issued/or issue"

does having a dedicated server make sense?
should we move them to another company in case they are disingenuous?
even if we move to a dedicated server do we need to pay for monitoring?
does it sound fishy?  
is this in the right forum?

thanks