CloudFlare sees traffic for hundreds of thousands of websites and was able to answer the question. They looked at the average percentage of requests that constitute threats, graphed the deviation, and overlaid any events happening on those days. Their conclusion: it depends on the holiday. Fergal Glynn, Director of Marketing, Veracode, sees the security quality of the thousands of applications we test. January through September is relatively flat and in line with the average flaw density. Then, there is a big bump in flaw density in October and November.
Source: https://threatpost.com/quality-coding-takes-break-holidays-why-122011/76018/