I think your suggestions are are good, but what you and I may be unaware of is how much crap goes un here. If 10,000 spammers are coming in each minute, there’s no way humans can deal with it — it has to be a robot.
Twenty years ago I had a website that was busy enough that the log file scrolled by faster than you could read any of it. I had constant attacks from Chinese hackers. I had filters that looked for suspicious activity and would block them, but it wasn’t enough. I could not deal with it, t he filters couldn’t keep up, so I blocked all Chinese IP’s.
Extreme measures? Sure. But it was the only weapon I had.