Suspicious process running under user

Hi! I often receive emails with the subject "Suspicious process running under user..." whose IP addresses are from Google Cloud. I have them added to the CSF blacklist and cPHulk but I keep receiving the emails with the same addresses ... Is this normal? Greetings