@ArneBab Thanks for the data. Hopefully I find the time to add some more stuff to my log analysis tomorrow so I can compare.
From what I've seen so far, GPTBot is the most common UA-string hitting my systems by a large margin.
Like, during the incident I use as my test data, I got 2795 requests from GPTBot, the second most common UA is Safari with 1594 and after that it drops all the way to 209.
But that's just around 3% of the ~100k requests of the incident actually identifying as GPTBot.