I do not see this as a Joomla issue (except the .htaccess file in Joomla root). From the small part of the log you provided in your question we can clearly read that the requests are made by mod_pagespeed and Serf as client. There is not really a question about it. The log identifies this user-agent info (Serf used by pagespeed). You cannot just simply avoid ...
It’s a good question and a bad question at the same time. Why? Good, because the question sounds ‘exotic’ for many many Joomla users/superusers. Why this small line of code is there everywhere like the coca-cola of Joomla. :) 'Nobody' understands why it works that much.
defined('_JEXEC') or die('gooo to hell!');
The question is bad because in the Joomla ...
Your first line of defense is your hosting service
Lease a dedicated server from a reliable hosting service
Ensure that you activate 2FA on your server and use a 'VERY STRONG' password
Install a reliable firewall on your server - I use ConfigServer
Install / Configure an anti-virus program, I use ClamAV
Ensure that each website username does NOT use the 1st ...
There is a good video from Joomla World Conference 2016 on a presentation of Namespaces by Jisse Reitsma that around the 23 minute mark goes into an example that eventually describes a situation where you would not use Jexec in your code so that it can be shared with other platforms like Wordpress/Magento, https://www.youtube.com/watch?v=Dyx05GR4Bms
With a ...
If you are creating a test questionnaire page where visitors fill out test questions as guests and submit their answers, then the whole process is usually handled by secure session/user/csrf tokens which is (created and) submitted together with their filled out tests Forms. The questionnaire Form should include fields like name, email address and CSRF form ...
You can check your logs for the pages that you don't want visited, and then develop some .htaccess rules to block access to these pages (or redirect access to the pages to the homepage). The beauty of the .htaccess file is that you will have all this "blocking" logic in one place.
defined('_JEXEC') or die; can be found at many, many php scripts in the Joomla framework to restrict the number and location of via entry points into your site/application.
This is a very deliberate form of security for what you are describing. If you aren't baking this into your new scripts, then you should.
Sometimes it helps (as a troubleshooting step at least) to disable mod_security.
With many hosts, this can be done by adding the following code to your .htaccess file:
See https://stackoverflow.com/a/12928404/1983389 for more details.
As at Joomla 3.9.0, there is a new "User Actions Log" included in the Joomla core which tracks logins, extension updates and extension configuration updates, for example.
Remember to enable the appropriate user actions plugins for this to work.