Without seeing relevant code of the app, I would suspect a browser plugin or something like that.

To better diagnose the source of these bogus requests, consider launching the app on a port that your browser(s) have not seen yet. If the requests still appear, then it is your app itself that issues that request (or some misconfigured other software maybe, trying a health check). I would then dump the IP address of the incoming request.

I would also look through the code for calls to the application, either through Mojo::UserAgent or app->....