Lemmy is a federated system and these stats are self-reported by user maintained systems. Rather than a sudden influx of users (bots or otherwise), a misconfigured system or hiccup in stats collection seems more likely.

Generally, Hanlon’s Razor, add applied to computing: Never attribute to malice that which is adequately explained by stupidity user error.

There’s a lot of malicious systems out there, but there is little corroborating evidence indicating that we’re under attack.