it looks like I'm going to have to block SEMRush on their IP/hostname now if they are faking being Googlebot.
You could, but in general it's more useful to follow keyplyr's approach of blocking anything that calls itself Googlebot but doesn't come from a known Google IP. (You don't need to do a DNS lookup every time. Just say 66.249.whatever-it-is.)
:: detour to raw logs ::
Huh. Is 192.243.blahblah really Semrush, or a faker? I kinda think a faker, since they're getting blocked while the 46.229 aren't.