Had a similar situation with a /16 at a research institution. Deployed non-interactive, multi-service sinkhole type honeypots across the entire /16 and collected a massive cache of data. A lot of fun developing something that could scale on that size of network. We used Go for the honeypots and Clickhouse to analyze the TBs of data.