I think I found my answer (mostly).

These hits are coming from Pingdom Transaction Checks that run every 5 minutes by logging to the website and making sure it works properly.

I'm assuming these bots are running in Linux but something must get lost in translation because Google Analytics thinks the user-agent is Safari, even though the pingdom docs say the user agent is "pingdom" in the user-agent or requests from amazonaws.com.

See this question for more info: Suspicious Web Traffic from Amazon.com ISP

I think I found my answer.

These hits are coming from Pingdom Transaction Checks that run every 5 minutes by logging into the website and making sure it works properly.

I'm assuming these bots are running in Linux but something must get lost in translation because Google Analytics thinks the user-agent is Safari, even though the pingdom docs say the user agent is "pingdom" or requests from amazonaws.com.

See this question for more info and a solution: Suspicious Web Traffic from Amazon.com ISP