This one - meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)
? We've seen huge numbers of hits from Meta's IP range and that user agent over recent weeks and that agent in particular. To quote them
I assume they might well run various things on their IP ranges, so given they are giving you a user agent maybe block based on that instead if you want to be more nuanced?