I am averaging 12,000 page views per day, but my cloudfront is getting around 6 million requests for images and fonts every day. I suppose it is possible that all of these requests are coming from my visitors, but I am having my doubts.
I know that I can enable keys and cookies so that only users of my website will be able to access the cloudfront servers, but I am not convinced yet that this is necessary.
Is there a way for me to check what percentage of the requests are from users that are being referenced from my server? Before I go and change my code to work with the private origin access?
Don't bother micromanaging and overanalyzing. Just use the keys and cookies now because that's good practice to protect your assets and bandwidth anyway. It's an easy decision to make, and you'll not have to spend four times the effort to track abusers.
The CloudFront section of the AWS console has several reports you can view or download, including a Top Referrers Report.
You can also enable detailed logging of each individual request, which stores the logs in an S3 bucket for thorough analysis.