Application-level banning seems very inefficient, these domains should be banned at the network (IP) level. Just drop any incoming packets from these domains/IPs, send absolutely nothing back that even confirms that you exist.
Google DNS are busy but its a hand full of IPs and reasonable. Cloudflare is non-stop never ending traffic. I don't know WTF they are trying to get. I've also seen TCP queries from those same Cloudflare IPs so this is not the result of a DDOS attack on them.
1. Breach router or desktop that hasn't been patched in ages via mass script
2. Establish C&C using cloudflare tunnels
3. Sell these hacked systems as residential proxy endpoints to everybody from state actors to teenagers
4. Some of them will be data scraping services
You are chasing your tail trying to ban by ASN or IP. It may work for another couple of months, at best.
People who used to contribute valuable content have pulled it because the bots were scraping it and reusing their work for free. Of course that was always technically possible but it used to be considered bad manners and not enough people did it to break the whole model. That's evidently no longer the case.
People who want to access real content are now interrogated with the assumption that they're probably a bot before they can even see a basic web page. Those interrogation systems are themselves are now running through a very small pool of providers with far too much influence and control to be healthy.
One of the most valuable means of communication and shared knowledge we have ever invented is being effectively destroyed before our eyes. I don't know what the solution will be - though I fear that the idea of privacy and anonymity online will suffer serious collateral damage - but I suspect that some new information network only available to people willing to identify themselves as a specific real human being in some relatively robust way will be a big part of it just as many sites are now gating their content behind user accounts.
I wonder whether the latter might be sufficient: have your terms state that user accounts are only available for real people and by using any automated system to attempt to create one the operator agrees to pay the site operator some ludicrous amount of money in recognition of the damage to their operating model that is posed by deceptively allowing automated access. And then make sure that such terms actually stand up in court - by legislating to enable them if necessary - in enough of the world to kill the AI scraper/bot model.