Ok, so the issue there is that not only there are canonicals from copied articles to the originals, there's a lot of sites doing it for the same content. Apparently, they are ranking, too, despite posting canonicals. Maybe they're cloaking, but I don't see the point in cloaking canonicals.
Also, the original site's traffic is going down. Likely due to these canonicals. The timing makes sense.
The suggestion here is to wait on disavowing, instead use Google's reporting tool: https://support.google.com/legal/troubleshooter/1114905
It allows you to report stolen content:
It was not explicitly made for text content, but it falls under "Other".
A few Nuances here to note:
- You can use something like screaming frog (for free) to scan the offending sites. The tool will grab canonicals and store them in a neat column. Get the lines with your canonicals and that would be the list of the urls for your subsequent reporting.
- While doing so, you will likely to see other canonicals there. Other sites are being exploited. Do consider reaching out to them and giving them a hand.
- The reporting tool is awkward to use, consider scripting it.
- The reporting tool has a threshold of about 200 reports pre day. Keep that in mind.