Found it.
The mystery caller wasn't a person — it was Applebot, Apple's web crawler. It was crawling our story pages (the ?id= links) and firing a request to an internal endpoint (/getitembyguid) without the id it needed, which is what threw the error.
Two things came out of it:
robots.txt rule telling crawlers not to hit that endpoint. Applebot checks robots.txt, so that should quiet it down for good.Thanks to everyone who helped look.