This sort of traffic is basically normal for any website that's been around for more than a few weeks. It's almost entirely malicious bots that are searching for things like a vulnerable Wordpress installation to break into or configuration files with database credentials so they can steal your data.
The nginx errors are usually because the server is overloaded. That's pretty normal for Johnny when server load is up. Apache restarts can also cause these. They're less of an issue on Tommy and nonexistent on Morty.
We generally just advise users to block unwanted traffic like this in .htaccess if they are causing load issues, though in your case you said they're hitting nonexistent files and getting 404 errors, which cause so little load that you likely won't even see it register on the load chart. We do not have an edge firewall or similar (we can't afford one due to our funding structure), though the server itself has a software firewall that we've used in severe cases to address an account under attack.
If you're would like, you can also file an abuse report with the owners of the incoming IP addresses in question. You'll need to find the company that owns the IP (pretty easy to do by googling it), then follow whatever that company provides for an abuse complaint. I've had success reporting addresses that are based in the US and EU, but you're unlikely to receive responses from hosting companies in countries like Russia and China (if they even accept abuse reports), where this sort of activity is tolerated (if not legal).