Comment by cryptonym

Solutions include TLS fingerprinting, browser fingerprinting, behavioral scoring, IP reputation, captcha/crypto challenge...

If you are on a premium CDN, they are probably equipped and can provide security consulting. If not, you may want to switch vendor or buy a separated bot detection solution.