I feel your pain, recently had something similar happen that forced a website I run behind cloudflare, there isn't much you can do when you get millions of requests in a day from tens of thousands of US IPv4 addresses that are on the residential networks you see non-malicious traffic from.

One thing that got me was seeing some of the malicious traffic originate from the same /24 as I use at home. Whatever botnet was being used certainly has good penetration of residential ISPs in the US!