I've noticed this as well, collected some information here:
https://gist.github.com/laanwj/2a89da909bf161c7e4c2

* It appears that all the hosts are from Linode, and that they open multiple connections (about 5-6)
* They claim NODE_NETWORK, but none of them has a sync height, so they're not actually requesting blocks (and will probably also not respond to getblocks requests, although I haven't tried)
* I've enabled verbose logging for them, and from what I've seen they don't ever emit any commands apart from pong and version. They just listen for invs.
* They do not accept incoming connections at least on the standard ports.