Is this an attack or a normal request?

[J.R.]

> Is this kind of DDOS attack or a legitimate request(which my server returns
> 400 for them)?

That's typically how various unicode characters are hex encoded. If
you aren't expecting that kind of input, then yes it is likely an
attack (probably trying to exploit an unknown specific piece of
software). Welcome to the internet where everything connected is
bombarded 24/7 from everything else with random attacks.

That's why it's important to keep your server (and wordpress) up to date.