So basically you are saying you have a CID that has a "Direct" or "Typed/Bookmarked" referrer?
That one is tricky... it could be that the traffic was redirected from A to B... in my experience it usually takes a lot of prodding to ensure that redirects maintain campaign codes (so if you have that you are very lucky - it doesn't help this so much). It's too bad they didn't complete the effort by forwarding the request headers...
If it was a redirect, hopefully you have a good connection to your DevOPs team.. you could investigate the server logs with them to see the redirection chain and try to see what the referrer was on the original hit to the site.
Its also possible that the URL didn't go through a redirect, but the source site suppressed the referrer. (rel="noreferrer"). In which case, there's nothing you can really do....
Or it's possible that someone started using your external CIDs for internal URLs... You could try using the "Previous Page" report to try and make sure that didn't happen.
Basically, you likely will have to do some investigation outside of Adobe to try and piece together what is happening...
