These requests are probably made by search/indexing bots. My personal server gets a quite a lot of these, but they rarely use any bandwidth.
The easiest choice (probably disliked by more savvy users) is to just enable cloudflare on your server. It won’t block the requests, but will stop anything malicious.
With how advanced modern scraping techniques are there is so much you can do. I am not an expert, so take what I say with a grain of salt.
I still wouldn’t believe it. Even the 404 article does not confirm anything and the ad company does not provide any details.
This whole thing feels like marketing, claiming something outrageous to get people talking about your company.