So I dealt with something similar a while back and it was a real pain. I was constantly getting requests for random pdfs and Mexican food recipes in my logs. The IPs were Googlebot, Bingbot, etc (their valid IPs too)
I found out about it initially when I saw a spammy looking domain show up in my backlink profile in Search Console and Ahrefs. In Ahrefs, though I saw that is was via redirect.
This took me down a rabbit hole of dns/ip address lookups, trace routes...the whole business. Long story short - ended up resolving to the ip address of a Cooking Site in Mexico. It was definitely hacked.
As an SEO, it bugged the heck out of me because basically it was like Googlebot crawling my site looking for these random Mexican food recipes, smart appliance manuals and getting 404s.
What did I do?
- I disavowed the spammy domain linking to my site
- Wrote a nice letter to the Cooking site's hosting provider (in
Spanish via Google Translate) informing them that it was hacked and sending bot traffic to my site.
Ultimately, there wasn't much else I could do! A couple months later it showed up as "lost" in my backlink report on Ahrefs. Happiest I've ever been to lose a link.
My site was less than a year old at the time...so I can't really speak to how this might affect your organic traffic/rankings.
All that said, the only thing I'd be concerned about is your server getting bombarded. If your situation is like mine, it will stop eventually.
EDIT: and your hosting bill...mine went up not by a ton...but fairly significantly.