What possibly could I do? As always: use reCaptcha, don't use reverse proxies. Nothing more you can do to protect from bots. If your spendings don't go crazy there's nothing to worry about. A bot or two will probably come by, but just put it in your costs.

That said I don't believe that these are symptoms of bots. I can't really give any explanation for that, but I don't believe bots would be detected by Google Analytics at all. And even if they were, they'd probably get a country.