If the reuse of a single IP address is not prevalent, these are hard to act against. Then you need a different kind of mitigation.
They usually follow a predictable pattern, like trying to hit every (almost entirely invalid) URL starting /product/1 /product/2 /product/3 and on up through the millions. They also will rotate the User Agent but neglect realistic/authentic values for other request headers.