I see most abusive request sprees with "Bun/1.3.10" in the header (as in the example) so if all those are coming from routstr users, should be the daemon - as I've checked, core is python based.