They tend to be coming from everywhere with all sorts of useragents, the only common factors seem to be they are all http1.1, anyway thanks for looking, I'll see what I can get sorted.
The Cloudflare addon shows the country and IP address for them all - which might help. If a lot are from, say China, you could also geoblock China with the Cloudflare addon. I found blocking some in htaccess helped. Bytedance in particular.