Hi there, I would love to help you with this and discuss further. I am a Masters of Information Security student and have background in web security too! Shall we discuss?
One solution I suggest would be to use Cloudflare on your site, if not using already, and properly configure it to block any 'bad bots'