Yes OnSpawn is the best place for it. I have on vault a script system that can do it, its called Boost System a variable driven random boosts. And it does allow to add hitpoints. If you would be interested about this look
here.
Without NWNX you can only use EffectTemporaryHitPoints which is a bit odd in early levels when monsters have 10hp and you add them 2hp, because if player damages monster by 1 point of damage, monster will appear not damaged.
With NWNX you can use nwnx_funcs (windows) which has a function to SetMaxHitPoints (but it doesnt set current hitpoints as well so you have to heal your creature as well)