HA failover pings that get routed rather than being sent to their peer, captive portal requests that no longer exist. Things of that nature.

There is a lot of documentation, Cisco being one of the primary at-fault companies, that uses 1.1.1.1 for all kinds of various internal configuration.

Given hundreds of thousands of devices configured with 1.1.1.1, even a simple misconfiguration on just 10% of those is a lot of garbage traffic.

I think that's part of the point of all this - to find out what all that garbage traffic is.