imo the way Google and other big websites deal with attacks and such (at least against static assets/non-abusable things like loading home pages) is the best, just absorbing them with capacity rather then trying to play a game of whack a mole. Cloudflare makes this possible pretty easily with caching, rate limiting rules and such, and then for bigger abusers you can serve challenges based on IP Rep and stricter rate limits on specific endpoints, accepting the fact that some bots/etc will always get through, make it a bit harder, but not hard enough to potentially give any real users too much of a hassle
