OK, so I ended up moving www.kernel.org to be served via Fastly and it's working well. I will probably move it back once we figure out what this okhttp traffic is.
The Linux Kernel Archiveswww.kernel.org
@monsieuricon Why not just blocking it and looking out for what IoT devices suddenly broke?
I wouldn't qualify myself as a BOFH but I definitely like some of his approaches when it comes to solving problems 