If you aggregate over a day, it might become more obvious. Also, datacenter network is a big red flag.

By the way, what's your opinion about running a cryptominer on requests from datacenter and bot IPs?