So I'll share an anecdotal story with no resolution....
I was also getting floods of zwave messages on my main hub. Pretty much exactly like the OP. It started somewhere around 2.1.6. That could just be coincidence, though, as I know I also made a number of motion lighting changes around that time.
In my case it was always triggered by the motion lighting app. I couldn't make motion lighting do it every time/at will, but if I triggered motion lighting events enough, I could get it to do it a few times a week - and it was 100% of the time initiated by motion lighting, nothing else in my case.
In my case it would go on spamming things until the hub was powered down. I mean graceful shutdown and pull the power cord for 30s.
My THEORY is that something was causing a race condition on the hub and THE HUB was actually bombarding the device with requests (not a rogue device bombarding the hub), So I broke out the sniffer, and yes - the hub was really sending the commands every ~200ms (typically setLevel and off commands in my case). Why? I have no idea, and I don't have time to debug/troubleshoot a commercial hub for free (especially without access to the source code).
At that point I moved almost all of my rules/logic off of Hubitat and into Home Assistant and Node-Red. And it has never happened again. So when people ask why I moved all my logic off the hub, that is the real reason why.
The End.
