I think it’s CGNAT. Especially since you already observed the number of unique IP addresses not rising together with the spike.
Can you see or monitor if it’s IPv4 or IPv6 sources? If it’s CGNAT it will be IPv4.
My graphs look similar:
And most of it is IPv4. But that’s a different topic 
