The description suggests that many files change many times per day, which is imo typical for temporary files. Additionally "newly deployed application" hints at a possible initial operational misconfiguration.

First isolate to prevent further damage, then analyse root cause.

Anytime we receive alerts/offenses that appears to be a potential scan (interna/external), we already verify with the app owner/client if this was expected activity.
We never close a ticket without confirmation, even its from an approved source.

The DMZ is a special network zone designed to house systems that receive connections from the outside world, such as web and email servers. Sound firewall designs place these systems on an isolated network where, if they become compromised, they pose little threat to the internal network because connections between the DMZ and the internal network must still pass through the firewall and are subject to its security policy.