• The only tcp/53 I have open is AMPR DNS (most connections are coming from 104.236.176.72)

Those are on my list of scanners/blackhats. The name "stretchoid.com" is already indicative of what they do. However, as Brian Kantor also wrote, it is a really bad idea to run a DNS server on an internet-facing interface. Keep it accessible only from the amprnet side.

Rob