Do you see a lot of imagebots in the logs perhaps? Might want to grep logs for user agents. Can block nicely with robots.txt and if bad crawlers with AWS Firewall or WAF. Could be someone trying to mirror content by scraping so look for IPs and rate limit then. Can use against logs if do not already have something.
GoAccess - Visual Web Log Analyzer