It's hard to judge the source or the purpose of these requests based on information you provide, but one thing is rather clear: somebody was translating request URLs with the wrong function, using HTML encoding in place of what it should have been URL encoding of the query part of the requested URLs.
For example, the sample you provide should read as:
If this was meant to be passed to another URL as a single variable, it would have to be translated using URL encoding, and it would look like this:
As it was translated with HTML encoding instead, the
& ampersand character (for example, there are other problems with it) denoting new URL parameter value will repeat in the HTML encoded string at wrong places, your web server has no way of knowing which parts are the URL query name and value parts in the format:
&field=value once it URL decodes the requested resource location.
This, I imagine, translates in all kinds of illegal requests listed in your web server's access logs. I would advice simply blocking all such requests in your web server configuration, as there is no way they can be served proper response anyway. How you'll do that though, is entirely up to you and your needs. I personally deny access to any User Agent (UA) strings that I deem having no business accessing my server, including default UAs of many web framework libraries, among which the one you mention:
I'm on Apache, and using PerishablePress' 2010 User-Agent Blacklist for these tasks (among other custom blocks in web server config and other means of controlling access, of course). It's in my opinion a convenient enough collection of blacklisted UAs, and while there are newer ones published even on this same blog, I find the one from 2010 to work the best for my needs. Anyway, I thought you might find it useful, too. ;)