they’re all attack attempts. set up fail2ban, enforce ssh key-based authentication, run it in a non standard port and create firewall allow lists for trusted users, networks or countries if you can. make sure everything is patched frequently.
expect consequences for running onion hidden services - captchas and denied service for that IP address, but also attacks against the hidden service itself.