Keys, like passwords, can be leaked, so it's possible there are databases of leaked keys out in the world, because unlike PGP or SSL certs, ssh keys don't have a revocation mechanism built in. So they could just try all the known leaked keys - like they try known leaked or default passwords.

Then there was this: https://jblevins.org/log/ssh-vulnkey (tl;dr - there was a bug in debian that caused ssh-keygen to only produce a very small number of keys rather than keys distributed across the whole keyspace). After that became public the bots were all about trying those keys for a few years after. To this day it's recommended to not used keys from that set.

Point being - the bots will try because it the tiny marginal cost is not high enough to stop the attempt.

They simply try password auth, and fail with a message that password auth is off. Constantly. All the time.

Set up a non standard port. This will stop over night.

It has stopped now (I simply removed port 22 from the whitelist except for connections originating with my home ISP, which is a local ISP where abuse reports actually work)

Have you tried port knocking as a way of temporarily whitelisting the right IPs?