Load testing microservice - bad results - performance

Question

I am struggling with the results of a load test of my api service.
The service is deployed on GCP. There are 2 instances running behind a nginx.
I am using spring boot 2.0 with default tomcat configuration.
The service is running inside a docker container with -Xmx768M
A request to the tested endpoint fetches a single row from a database and returns it.
My results:
ab -c 1 -n 1 /testapi
Requests per second: 15
Time per request: 63ms
ab -c 10 -n 100 /testapi
Requests per second: 102
Time per request: 97ms
ab -c 50 -n 100 /testapi
Requests per second: 95
Time per request: 522ms
ab -c 100 -n 100 /testapi
Requests per second: 93
Time per request: 1065ms
ab -c 200 -n 200 /testapi
Timeout
Worrying aspects:
Heap usage is rising after each test
At 99.99% heap usage I am getting slow responses until the container crashes with java.lang.OutOfMemoryError: Java heap space
I am able to ddos 2 instances of an API from a single laptop.
What am I doing wrong here? Does the tomcat configuration needs further tweaking? Are the JVM parameters wrong?
Thanks
EDIT tested code:
#ApiOperation(value="Get Device", response = Device.class, authorizations = {#Authorization(value = "Authorization")})
#RequestMapping(value="/device/commnr/{commnr}", method= RequestMethod.GET)
public DeferredResult<ResponseEntity> getDevice(#PathVariable String commnr) {
final DeferredResult<ResponseEntity> deferred = new DeferredResult<>();
HttpServletRequest request = getCurrentHttpRequest();
timer.schedule(new TimerTask() {
#Override
public void run() {
if(deferred.isSetOrExpired()) {
throw new RuntimeException();
} else {
User user = authenticationService.loginUser(request);
Device device = deviceService.findByCommNr(commnr);
if(!AuthTools.isUserDevice(device, user)) {
deferred.setResult(new ResponseEntity<>("Requested Device does not belong to user.", HttpStatus.FORBIDDEN));
}
if(device == null) {
deferred.setResult(new ResponseEntity<>(HttpStatus.NOT_FOUND));
}
deferred.setResult(new ResponseEntity<>(device, HttpStatus.OK));
}
}
}, 10);
return deferred;
}