So I work for a smaller regional ISP in the Midwest. I can definitively say every single notice we have ever received about any IP addresses on our network causing a problem has always been a compromised legitimate device on a user’s network. Most of the time it’s somebody installing a shady app on their smart TV/streaming stick.