Someone is running TOR to mask their address.
May or may not be malicious.
Some cryptocurrency apps use TOR internally when interacting with other clients.