I had a virtual server in the Phillipines with Lightnode that was also constantly under load with upwards of thousands of requests per second from some IPs. The requests had strange patterns in them and came mostly from residential IP address blocks. I think those were probably caused by a broken NTP implementation on some device, but I was not motivated enough to investigate further. The topic was discussed here: Certain servers are not replying - #20 by Sebhoster