There frequency of "game-changing" in comments would say otherwise. It's probably cron running at those intervals, not a work schedule.
Have you tried running any network analysis on these bots? I would expect to see strong clustering, and I think that's usually the primary way these things are identified. The prompt injection is an awesome approach though!