What is the reason behind bots spamming marginalia? What’s the motivation? What do they gain? I always wonder about these things.
My best guess is they're assuming it's backed by google, and are attempting to poison its search term suggestions. The queries I've been getting are fairly long and highly specific, often within e-pharma or online casino or similarly sketchy areas.
Many of these bots are exceptionally simple - zero tailoring, just scriptkiddie copy/past/run stuff.
They could simply iterate through a list of websites inputted by the user. Said list could be some curated list you find on blackhat forums, which is just a collection of websites with traffic over a certain threshold. Doesn't say anything about the content or what type of website, just the URL.
Then it does a simple operation to map the website - as well as checking for input forms. If an input form is detected, it does a POST operation. If there's an error, timeout, or whatever, it simply moves to the next one.
This of course sucks if you try to run a search engine - because even the simplest of bots will succeed when your website is literally just one website, with the text/input field right there in the front, and with no captcha or similar to dissuade legit users.
There are also some vulnerable plugins still out there if you actually want them to hack it.
A couple of my toy/project websites accidentally became honeypots. Rather than shut down the comment forms, I now have those sites generate summary logfiles that I can upload daily to AbuseIPDB.
EDIT: Forgot to mention, also log the Referer field and User-Agent on each request. Very, very useful information for research and detection.