I have a similar issue with Cerber 5.5. I have blocked the REST API and overall I see a number of “random” requests that the plug-in now protects me from.
Normally I put my home IP in the white list; but I am currently away from there – and so I am signing on. This is logged with my IP.
I then see a series of rejections using my IP with the URL site/wp-json/jetpack/v4/jitm while we are on the admin page.
We do have Jetpack installed – so I assume that Jetpack are now wishing to use the REST API. Doubtless other plugins will follow this route.
The code itself is in /wp-content/plugins/jetpack/_inc/jetpack-jitm.js
Would it not be reasonable to say that a currently logged-on user would be able to use the API – and not reject them? [I do understand that a rest request coming from a non-logged on user session is more tricky to detect – and would be rejected.]