Just because Steam offers a DRM option doesn't mean that it's mandatory:
https://www.pcgamingwiki.com/wiki/List_of_DRM-free_games_on_Steam
https://www.pcgamingwiki.com/wiki/The_big_list_of_DRM-free_games_on_Steam

There's also @Deep@mander.xyz, @Beep@lemmus.org, and there was one named king but I've forgotten what instance they were on since they were last active.

"YOU aren't the one that gets to decide if you have something to hide!"

Is steam the only program you've noticed having issues? If not then here's a scary possibility to consider: Hardware Failure
I recently had my power supply destroy my MB and SSD and there were signs that I ignored just before it all went down.
If you still have your arch install usb available then boot from that and pick the memtest86 option in the boot menu to see if your ram has any faults.

I found the same IPs doing the same thing for my server, but one thing I noticed in the access log was that nginx was returning a 499 status code. That code means that the client closed the connection before the server answered the request. So this seems to be a deliberate attack instead of the rash of bots many have been dealing with recently. They just firehose out requests to DoS the server since pagination on services with dynamic data is expensive.

I ended up creating a fail2ban rule to add any IP to my firewall blocklist that makes a bunch of 499 entries.

Edit: I also set a rate limit in nginx for any url that has a "page" query included

If you're using linux then check if quilt is available for your distro, it's made specifically to maintain patches on top of a codbase you don't control: https://wiki.debian.org/UsingQuilt