Botnet scraper. Or maybe a zero day in tor that NSA might have discovered and is trying to exploit it . 600K to 1.2 Million is effectively double the traffic . But what bothers me is that all of these are clients , if they were relays then that would make sense.But NSA has gotton more aggressive and out-front after the leaks though.

edit: fixed typos