An entity LinkingLion, active since 2018 and on a Monero banlist, is opening connections to many clearnet Bitcoin nodes. Its presumably attempting to link transactions to node IPs. Maybe a chain analysis company trying to enhance its product?
From @lopp :
Bitcoin node operators may run these to block a suspected surveillance service:
bitcoin-cli setban 162.218.65.0/24 add 315360000
bitcoin-cli setban 209.222.240.0/24 add 315360000
bitcoin-cli setban 91.198.115.0/24 add 315360000
bitcoin-cli setban 2604:d500:4:1::/64 add 315360000