I am really having a hard time understanding what OP is describing. Does anyone have a video example of the phenomenon?

The resources required to port scan every port on every IP is generally not worth it. AFAIK they tend to stick to lower ports or popular ports. Unless they’re intentionally targeting a specific IP or IP range, they’re just looking for low hanging fruit.

Are you not actually open to the public internet? Is it running on a nonstandard port? Is it already pwned and something is scrubbing logs?