Amazon EC2 is a virtual hosting environment. An IP address allocated to EC2, as evidenced by the *.*compute*.amazonaws.com hostname in reverse DNS is, most likely not providing an official product offered by Amazon Web Services (AWS), but is more likely to be assigned to a virtual machine (or cluster of virtual machines) that an Amazon customer has leased, to deploy their application. Some AWS official services do run on EC2 and live in the same address space, but this traffic pattern is unrecognized by me.
Not all AWS services require HTTPS, but SES does, so that can be conclusively ruled out. Also, these requests look nothing like SES requests on the wire.
You appear to be dealing with an unscrupulous/lazy/unskilled developer of some kind of app or service that is popular with your users... or malware... or an internal developer using something installed on an EC2 server that is not appropriately secure.
Regardless of which of these the case might be, blocking these particular destinations (specific IP addresses) seems an entirely appropriate short-term security response to help you identify the real nature of the traffic.
A long term or subnet-level block is not appropriate, because any EC2 customer can change their IP address any time, which could leave you with legitimate services blocked when a legitimate service subsequently begins using the address.
