Segment them by ip, npub, type and randomly check the content.

Perhaps the relay has been added to a client's default list?

Or someone with a lot of follower used it and so other clients are adding it to the req events.