Hey, im having exactly the same thing.
This started happening once I made the DB “externally accessible” (by following this guide). I made it external using ipv4 because I was worried about compatibility if I made it ipv6.
I had something like this when my Database was hosted on Heroku too. I asked support at Heroku and they told me that its bots that are attacking it and theres nothing you can do about it.
It seems like there are bots that are continually scanning the entire ip4 address space looking for postgres instances and when they find one they just start trying to brute force the password.
Am I correct in thinking this or is there something else going on here?