What’s the IPv4? I believe Cloudflare has different prefixes for WAF, warp, and workers.
2a06:98c0:3600::103 is definitely a Cloudflare WAF IP, so my guess is someone using either warp or workers is sending requests and added that IP to X-Forwarded-For as a red herring.
This probably isn’t too useful for you as they only have 24v and 54v models, but Ubiquiti used to make EdgePower UPSes. They have a http management interface that lets you monitor the power usage or power cycle the router if a ping stops responding, and etc. I installed one recently for a POE switch of mine.
So it seems I was wrong about Cloudflare having seperate prefixes for WAF and workers. And these are all WAF/workers IPs (but not warp). My guess is that someone’s made themselves a http proxy worker, and are using that to proxy their bot’s requests.