It seems pretty clear it's the NTP servers themselves. All the servers are in the same small subnet, and 2 of them even have rDNS hostnames indicating they're owned by shodan.io.