Additionally, many enterprise email security providers doing automated phishing checks that click every link in the email and screen scrape the landing page to verify it's not an attack vector. If your market is the govt, schools, or large enterprises, this is absolutely juicing your CTRs.
Vanity email metrics are incredibly broken right now - the only numbers that mean anything are frictioned conversions like sign-ups, payments, session duration etc.
But auto-clicks seem pretty easy to filter out of reporting data because they happen essentially instantaneously. Just drop clicks that happen within like 10 seconds of delivery.
I don't know this exact thing to be happening, but it could, so I don't think using IP location as the signal of "Human vs Not" is accurate.
Using time clustering of clicks vs send is a good one, also I've noticed that these security providers will click _every_ link in the email, all within a few minutes, so filtering out multiple clicks by one IP in a short time frame would work.