We're receiving notifications for this 1018 REST API error - but I don't see a way of finding where the request is coming from - is there any way to look at the origin of these errors?
This is reason #1 that passing all Marketo API calls via an API gateway is advisable. You just don't have that visibility.
Without the gateway, you have to start switching off integration users until the errors stop -- you'll be disabling production connections as well, and the integration that's triggering this error may be doing other things right.
Do you have an implementation guide for that?
Depends on the platform. With AWS API Gateway it's pretty much a standard Proxy config. That's AWS's catchall config, for all API methods exposed by a certain host, like {Munchkin ID}.mktorest.com.
Not to say it's easy to get up to speed, but the individual config for Marketo (once you have the grounding) only takes a couple of hours to test and deploy. Again I don't want to portray this as easy, just necessary.