It does not matter who this is. Foreman API require authentication OR valid X509 certificate for some endpoints (this one does). If it, for some reason, is not considered valid, Foreman can likely fallback to username/password authentication and since there is nothing in the request this likely is seen as empty strings or nil values which are considered as incorrect passwords, counter of failed logins increases for this IP until it is banned for 5 minutes.
Please test this and if you confirm, we would ask @aruzicka for an insight.