I just checked my own webserver logs (I also run a sever in the ntp pool) and I too see some hits in my webserver logs.

They look to all be log4j vuln scanning activity (CVE-2021-44228), and the volume isn't that high (a few a day, and not every day). They just have some overzealous vuln scanning. And yes, they shouldn't have the NTP pool under their DNS name.

I've had all sorts of strange things happen because of my ntp pool membership, this one is pretty far on the benign end of things.