I plugged a repo on my own GitLab instance into godocs.io to see if my logs work. Instead of getting one clone from godocs.io, I got over dozen clones within ten minutes.
We can run our own Go module proxy and configure godocs.io to use it, or we can add write support to the Go module cache backend and configure godocs.io to use that (it is currently read-only). Running our own module proxy might be easier. Either way we might want to avoid storing source code indefinitely, so we may need a way to eventually delete the source code for old modules.
proxy.golang.org has a new cached-only endpoint which only serves cached module information. This means that requests made to that endpoint won't trigger any clones. We have been using this endpoint in production without issues for a while now.
We could run our own proxy, but that would add additional maintenance overhead. Plus, many people already use proxy.golang.org, so clones may still happen even if we don't use it. Also, I believe that the Go team attempted to address the problem of aggressive cloning a while ago.
I'm going to close this issue for now. Feel free to reopen if the module proxy is still causing you problems.