That timing could also align with a device that is turned on and off at specific times, for example an insecure smart TV that is generally turned on to watch TV in the evening, and turned off around midnight.

Though the fact that it lines up with an 8 hour shift also makes it seem human-like, so I think I'd rank a human carrying an infected device as more likely than an infected periodically-active device.