I have 3 instances of what looks like human hits from 199.247.46.x, 199.247.45.x, and 199.247.47.x (Sept 9, 25 and October 16). Those IP's are in 199.247.32.0/20 - assigned to Symantec. It's part of AS396982 owned by Google (Google private cloud). A look in that AS shows Blue Coat Systems, Norton Life Lock, Salesforce, and others.
I'm not up on Symantec products - can someone surf the web through them? Like some sort of secure proxy?
I'm not keen on allowing surfing through security add-on products (because I don't really know the ultimate IP source of the browser) but in general I don't see bot activity using them so I figure I'm better off allowing it given that some of my customers are in the institutional / corporate sphere and I can see them using a secure proxy.