It would be strange for there to be bot traffic, unless it's a heartbeat request from the local server itself, as all our requests run under a service account.  Where can I send a sample log?

Bots regularly attempt password guessing attacks on IMAP/POP/SMTP/etc so if those protocols are exposed to the internet you'll likely see this pretty consistently. The webmail NA's though could just mean someone landed on the web interface but then never logged in. Sample logs can be submitted on a support ticket where we can work with you to get to the bottom of this. Thanks Peter!