100 CDIFFs or so behind, and they download it nearly 2k times in a row?  Why?  This is not a partial download either.  It’s the full file.  Stuck cron?

Who in the past 24 hours has created 22.17M file downloads all by themselves from a single IP. (The main.cvd btw)

You *may* be forgetting NAT.

Eg, it's possible the first one is a network of a few thousand computers going through a NAT firewall where each of them has had an old daily.cvd copied onto them in an internal release cycle or something, so each of the computers on that network is trying to download a backlog of CDIFFs. (Or maybe another problem stopping the updates has been discovered and fixed, or something)

I'm not saying it is, but it may be. If you are only analysing by IP address, NAT will innocently cause strange results.

-- 
Paul