Is there a way to stop this ? I assume that the connections would all be coming from one IP (or batch) but finding out and blocking this would be useful.
One possible useful observation - the attacks come only on the 96kbps Ogg channel.
I don’t know specifically how to do this but I would check your icecast2 logs and possibly research how to block IPs from Icecast. This would be likely best handled on the icecast level vs. LibreTime level. I tried to google for it and it might even make sense to do it at a higher level if in looking at the icecast2 logs you can find a certain IP that is causing the traffic - see https://www.cyberciti.biz/faq/how-do-i-block-an-ip-on-my-linux-server/
I am not really sure that fail2ban would work in this situation, but I’d say that a bot would make many connection attempts in a short period of time from the same IP