404 Lockouts – concurrent hits to different urls from single IP

So without question Defender is doing heavy duty today on one of my multisites but a couple of anomalies… I’m getting multiple 404 lockout alerts for single IP addresses concurrently hitting multiple bogus urls. Can someone explain that in terms I can pass on to my very un-tech savvy colleagues? Also, permanent block doesn’t seem to work at all … I can set the lockout time way up, but if I check the box for permanent block (so I don’t have to do that manually .. which I’ve been doing all day long….), the notification just says lockout is for the time set