I'd be checking for bugs in the js -- particularly as might be triggered from a bot environment that one or more of your customers might use to test their site or observe their sites latency response ...

puppeteer with setRequestInterception configured to block responses in the right way maybe https://github.com/puppeteer/puppeteer/blob/v5.5.0/docs/api.....

I can imagine nightmares along those lines that could persuade some normally functioning js client logic that works normally when in a normal network environment to continually reissue failed requests when browser requests/responses are blocked in just the wrong way -- that could cause the same client side ip to appear in logs over and over again.

And then ip variability could be the customer spinning up browser bots in various regions around the world in order to measure their sites region specific latency response.

Just offering up an alt theory -- as I'm with some of the others -- not sure the graphs shown immediately scream dos to me.