What this bot/IP trying to do on my civicrm site?
It's a SQL injection attempt, where it's looking to see if it gets used in a query and alters it. Depending on the query where it gets used, it could do nothing or it could do something, but at the very least tells the attacker if it's vulnerable. Simple example, where it does nothing:

If civi had code like this, where it doesn't escape the value:

$reset = $_GET['reset'];
$dao = CRM_Core_DAO::executeQuery("SELECT * FROM table WHERE something='$reset'");


That particular url would translate to:

$reset = $_GET['reset'];
$dao = CRM_Core_DAO::executeQuery("SELECT * FROM table WHERE something='1' AND 6876 IN (SELECT (1)) AND 'KFmQ'='KFmQ'");


which is valid SQL and does something different than intended. In my example all it does is tell the attacker it's vulnerable, but there's lots of variations.

Since IDS is catching it, you get the log errors.

If it's always the same IP, you can block the IP.