In my Apache Tomcat 8.5.56 localhost_access_log.2020-06-26.txt file there is, instead of a POST or GET request, a strange line:
X.X.X.X - - [26/Jun/2020:00:28:00 +0200] "CONNECT check.best-proxies.ru:80 HTTP/1.1" 400 795
what is it? Is it a socket connection? The server is exposed in the public cloud in the us-central-1a zone.
I'm afraid that what's inside of a GCP Instance is out of our expertise, anyway I'll do my best effort to help you.
This is some documentation that explains further what means the method "CONNECT". https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/CONNECT
The HTTP CONNECT method starts two-way communications with the requested resource. It can be used to open a tunnel.