bluebearmedia on "[Plugin: Wordfence Security] xmlrpc.php"

They're likely just "pokes" to see if there's any site response.

If you don't need to do use any remote site operations/services, you can disable xmlrpc completely (either in your functions.php, or via plugins).