Definitely local. You were probably compromised at a local business who had your name, email and address. Those 3 hotels likely accept anyones packages and are open to handing them over to anyone who asks for them using the matching name.

Yes. I would file a police report. I personally would call those hotels and tell the manager what happened. I’d feel better that I educated them and possibly thwarted the receipt of other fraudulently bought items.