I've been seeing some traffic like this recently as well. We've been getting a lot of traffic this year from addresses that were marked as DoD and Redhat as recently as 1 year ago. It is like a new form of domain name squatting, but using stale ARIN records instead of DNS. Of course, neither CloudFlare nor Google Analytics alerts anyone to this problem, and they just let it pass as if it is normal traffic. I only discovered this after having to ditch Google Analytics and develop an application level firewall to satisfy GDPR requirements.