Was it just a VPS based ploy to temporarily fake demand for the protocol?
there is indeed speculation that only a few people are running the majority of classic nodes via aws or similiar services. a user on reddit claimed to host 800 vps classic nodes alone on aws, see https://www.reddit.com/r/btc/comments/4aka3f/over_3000_classic_nodes/d113ffi
the comment is two months old and announced that those crowdfunded nodes will go offline in mid-may, which would fit the current drop.
not sure about the fake demand part of your question, as I don't think there is anything malicious in vps nodes per se and that a good amount of core nodes are on vps too.
btw. 21.co has a couple of nice charts regarding node distribution: https://bitnodes.21.co/dashboard/#user-agents
