Constant POST request spam to /cgi-bin/ViewLog.asp endpoint

It looks like an automated search for vulnerable machines over the 'net.

The "127.0.0.1" host can be a faked part of the http request that comes from some other address. 127.0.0.1 (localhost) gets less security checks in a lot of networked systems.

It is rather unusual, but not absolutely pointless for someone that already can execute code on your machine to scan for vulnerabilities from inside - he is already in.

You may as well look for HTTP access log and see how this request is logged.

---

As for DNS: unless you know what you are doing, don't run public DNS.

p.s. no one can say if your machine is compromised, but since it is for temporary use, it is better to reinstall it.

You are right about the fact that he host header can easily be faked, however I assume that you've got the POST http://127.0.0.1/cgi-bin/ViewLog.asp right from yours logs - and that indicates that the requests come from (or via) your localhost indeed.
Some attacker code might try to exploit:

https://www.exploit-db.com/exploits/43884

which is aimed at (rebranded) Zyxel and Billion routers. This attack is unlikely to cause any harm to you as you're obviously not running your node.js stuff on a router, however the sole fact that something uncontrolled seems to originate from (or be forwarded by) your localhost should be investigated.