Thanks. Since it appears all this traffic is Google-related, any guesses as to what the attacker could have gained here?

This could just be a mistake of course, malicious intent isn't needed :)

Of the top of my head, assuming malicious intent, well not all browser (especially older ones) do certificate pinning, so perhaps then Chinese users of Google services using old browsers would find their traffic being intercepted?

Past that the leakage would seem fairly minor, a list of source IP addresses and destination hosts.