How can my users discover my upstream server IP though they only connect through load balancers?
Solution 1:
You kind of solved the mystery in your reply to my comment: If your IP addresses can be guessed, then they can also be guessed by your less welcome users.
Public sources like certificates, previous network-scan results or simply whois entries allow one to guess which (more so if consecutively numbered) IP address blocks are managed by the same party.
As long as the service you provide remains vulnerable to whatever attack you observed, the guess can then be quickly confirmed by watching your service become unresponsive.