I think I found my answer (mostly).

These hits are coming from [Pingdom Transaction Checks](https://help.pingdom.com/hc/en-us/articles/203910642-Transaction-Checks) that run every 5 minutes by logging to the website and making sure it works properly.

I'm assuming these bots are running in Linux but something must get lost in translation because Google Analytics thinks the user-agent is Safari, even though the [pingdom docs](https://help.pingdom.com/hc/en-us/articles/212979949-Google-Analytics-and-Pingdom) say the user agent is "pingdom" in the user-agent or requests from amazonaws.com.

See this question for more info: https://webmasters.stackexchange.com/q/87405/83219