How many repeat clicks from one IP address is suspicious?

There is no threshold that settles it, and anyone quoting one is guessing. Offices, universities and mobile carrier gateways put many genuine people behind a single address, so volume alone proves nothing. What matters is the combination: repeated paid clicks, sessions ending almost immediately, no page depth, no conversions over a long window, and an address that resolves to hosting rather than a consumer ISP.