I have a Relay and a Bridge up and running with ssh password disabled, ssh port changed and fail2ban installed.
With that I noticed that one particular IP was trying to ssh my both machines and that IP belongs to Liberty Global, an Anglo-Dutch-American telecommunication company which is owner of the Virgin Media, UPS and Vodafone.
I was wondering, why is this company trying to ssh my Tor machines?
It could be an exposed router on their network someone is using to probe you. Just ban like your currently doing, restrict to specific IP, and/or change your Ssh port is about all you can do. Ssh scanning bots out there are as numerous as plankton it seems. XD