I looked up the IP 18.104.22.168, and it seems to be owned by SEMRush. So the possible reason is that you have second-hand domain that the old owner created those pages and SEMRush still has the list of those pages. So SEMRush is trying to crawl those pages, maybe to see the backlink or other parts of the pages for SEO analytic.
To confirm that you may contact SEMRush it's self. Or you can also block those IPs using cPanel's IP blocker or from other WAF like Cloudflare. If SEMRush is good robot you can use robots.txt as Max's comment too.
Another possibility is like Stephens's answer, if your website really hacked the best solution is creating new website with new hosting(or cleaned hosting), just import the articles/posts from old website, don't import plugins, themes or other code/script from old website. Because it's will really hard to handle especially if you don't know programming and server.
xmlrpc are very common, even your website is not a WordPress you can get those requests from random IPs. I has many clients that use static HTML but still get requests to those pages. For non-wordpress site, that's harmless(except spending bandwidth). But for WordPress site, those requests can be handled by Stephens's guide link.