Click fraud is malicious activity where someone runs bots that click on ads for specific category keywords. For example, if this is a villa rental website, someone like competitors or a large platform, might use ad agencies that perform click fraud against the villa rental website to exhaust their budget and therefore get more traffic themselves. In the case of an entertainment agency, it might be other competitors interested in your traffic.

The first step you might take is to check that you are not advertising with AdWords partner networks, as they might be the reason for the clicks on your ads.

Second, you can check your server logs and verify clicks from Google Ads, especially the geolocation of those clicks. If they are not from your region and the visitors perform no action after viewing the first page, this is most probably click fraud.

I use our own open-source security platform (I'm a co-founder) for this purpose (1), as it's server-side and works even if bots aren't running JS. However, your website analytics might also be useful if they can collect events without JS.

1. https://github.com/tirrenotechnologies/tirreno

Invalid click rate is not always a reliable metric.

I've been dealing a lot with click fraud on Google Ads, and it's usually hard to detect it without special tools.