Just had fed a bunch of IPs from one of my server's auth.log and got the same:

  "country": "China",
  "threat": "unknown",
  "risk_level": "1"

I'm not surprised but with increasing China's activity on the scene we have to do something with it.