Have you considered more conservative rate-limiting external IPs on login endpoints?

E.g. with nginx it will make sense to set a custom rate limiting zone to prevent many requests from the same IP specifically to the login page:

https://www.nginx.com/blog/rate-limiting-nginx/

This will not fix the root cause, but will make it considerably harder to scan for matching passwords.

You can also set up Fail2Ban to block IPs that failed to authenticate many times:

https://serverfault.com/questions/421046/how-to-limit-nginx-...