Please help! Is my blog traffic 'real' or 'bots'?

Hey there Warriors!

First, I'd like to say I'm really happy to be a part of this lively community. I'm really hoping someone can help me with a concern I am having with my blog's traffic. I would appreciate any assistance anyone can offer. Thank you in advance!

I run a food blog which generates quite decent traffic through social media and search engines. The blog isn't huge or anything, but it does alright for itself (Alexa Rank 300,000+). A huge proportion of our traffic comes from social media shares (primarily Pinterest and Facebook) and search engine hits (about 300+ a day, not much but it's alright).

However, I recently decided to purchase some web traffic from a site with a fairly good reputation on the Internet. This site promised targeted geographical traffic by 100% real people, without a single use of bots. They generate traffic for clients through owning a big network of expired domains which populate with links for visitors to click through. Purchasing traffic through them means a link to your site is added to the list of sites on their expired domains. This is what they claimed. Also, they do not work on the basis of Pay-to-surf, pop-up ads, pay-to-click, etc. They merely list the site on their repository of expired domain names and have people choose to click on a given link out of their own free will. Sometimes they utilise XML feeds too.

So far their services have managed to deliver the traffic I paid for, without any issues. Communication on their end is also very good. However, I am having concerns with the ways this traffic is appearing on my Google Analytics. In particular, I have been noticing several weird referral addresses popping up as IP addresses.

At first I was concerned that this company was actually using automated bots, which is a big no-no in my eyes. However, a closer inspection of the data revealed several curious finds (See attached image)


(This image only showcases Referral traffic, not other forms of traffic. The IP addresses only appear in this category of traffic and not others)

I was hoping that someone here could please assist me in interpreting this data, and helping me determine if indeed this company is using bots instead of expired domain traffic as they promised. I don't want to jump to erroneous conclusions so I thought I'd ask the experts here first. Several concerns of mine include:

1) Why are the referral sites appearing as IP addresses instead of actual site names? Clicking on the individual IPs in Google Analytics reveals /redirect_ref.php and /redirect_js_new.php fields, which I found to be rather unusual.
2) Why is the bounce rate so oddly low with traffic coming from these sites? 4-8%? (I did not install my GA code twice by accident)
3) If bounce rate is low, why is the average page session only slightly more than 1? Doesn't such stats contradict each other? :O Shouldn't low bounce rate coincide with higher average page views?
4) Is the Average Page duration time indicative of bot activity or real humans? Usually, traffic from my social media sources averages about 1 minute in length, which is about the industrial average for food blogs (since people just scroll down to the recipes or save them immediately). So the average page duration from these IP addresses is on the lower side; however, they aren't as low as what bot activity is supposedly like (0.00).

I would so greatly appreciate any advice on what I should do and if such traffic could prove dangerous in terms of violating ad policies, etc. From my interpretation, the traffic does not since I am not paying anyone to click on ads nor forcing them to see the page through pop-under pop-up ads. But I'm a noob so I may be missing out on important stuff. Are they indeed using bot or real traffic?

Looking to hear from you! Thanks so much for your assistance!