Click Fraud using Cloud Servers?

Could someone please explain the mystery I have? I am very curious to know what is happening. We are getting a lot of product ads campaign click originating from amazon cloud servers in Ashburn, Virginia and Datacenter in Jacksonville, Florida ( 800 Water Street Jacksonville, Florida).They register Direct Visit as referrer.

First product ads campaign are not like other display ads. They only show up in google search or their search partners. So it is not like someone from Africa or China can make money by displaying our ads on their fake websites. So could it be one of our competitor trying to sideline us? But then it is coming from many different ips (but most of them came fro same block as amazon cloud servers), so if our competitor is doing this, they must be doing some serious click fraud.

Or is there another reason that those ips should be showing up in our ad campaign hits? Could google search partners be using these cloud servers and somehow they are not forwarding user ip but instead their server ips? Should I block those ip blocks in google?