I'm a bit confused because it does show the block is assigned to the US military but it has a high fraud score so I wonder if it's leased or somehow being used by a bad actor. Also as you've already seen, some VPNs use it as a local IP like 192.168.1.1 for the VPN interface itself.

You probably found that old reddit post talking about shadowsocks?? I think that's unlikely unless you keep that very old app version around. (But there could be other software you're playing around with?)

These are large address spaces reserved in the early days of the internet. I have no idea if the DoD even uses that one actively. Maybe somebody repurposed that network? Maybe you operate an authoritative DNS server? Or you just got scanned by some random crawler looking for compromised systems or vulnerable IoT devices...

I found this additional info: https://blog.erratasec.com/2013/12/dod-address-space-its-not-conspiracy.html