Yep, three things.
A) You have bot or an a**hole webscraper crawling your site and making a ton of bunk checkout caches. You need to invest in a web application firewall like Sucuri or Wordfence (use the paid version, not the free one in either case). If you don’t do this, you are going to have this problem again, and again, and again ad infinitum. You are also going to want to check your server’s access logs and block any IP addresses that have a ton of requests in a very short timeline unless they are google, bing, yandex, or another search provider you care about for your SEO. If they aren’t, they are either sniffing your site for holes to steal money, or are trying to steal your catalog/image/etc because they are running a clone shop and they are to lazy to lay it out themselves. Either way they need to be blocked, and the WAF (Sucuri or Wordfence) will insure they get blocked again quickly when they inevitably change their IP and try again.
B) You need to flush your cache. The following query should do ya pretty good:
DELETE FROM wp_options
WHERE option_name LIKE '_wc_session_%' OR option_name LIKE '_wc_session_expires_%'
Some of your legit customers might grumble slightly. However if you don’t do this, your website will eventually crash and your database will get corrupted and irrecoverable, which is way worse. Run a SQL dump before you do this if you want a backup, but caches are pretty much trash anyhow, so it’s not that important.
C) You need to make sure that wp cron is working correctly so the caches flush on an appropriate schedule. Make sure that the following line does not exist anywhere on your installation:
define('DISABLE_WP_CRON', 'true');
You can grep for it to do that quickly.
To make sure this doesn’t become a recurring problem, it would be wise to set up a CDN like CloudFlare or CloudFront to cache all of your product pages but not the checkout, and not forward headers or cookies to your site for the products unless they are not currently cached. You then set up Woo to only allow the cart for logged in users, which makes it inaccessible to bots. It is usually a good idea to let people login with google or facebook if you do this so you don’t get too many bounces from customers who don’t like the hassle of logging in.