Interesting. Came to similar conclusions when analyzing my (httpd) access logs for https://turmfalke.httpd.app/demo.html ... but so far nothing really out of the ordinary.