I would say bot for sure, maybe admin can take a look
What possibly could I do? As always: use reCaptcha, don't use reverse proxies. Nothing more you can do to protect from bots. If your spendings don't go crazy there's nothing to worry about. A bot or two will probably come by, but just put it in your costs.
That said I don't believe that these are symptoms of bots. I can't really give any explanation for that, but I don't believe bots would be detected by Google Analytics at all. And even if they were, they'd probably get a country.
That's true their is no real way to prevent bots from visiting your website, problem with captcha is you can hire captcha solving services and implement that into the bots so they solve captchas as well but like you said I do not think google analytics tracks bot activity