Are you being bombed by a foreign entity? I was being spammed by users in Singapore so I blocked the country and the malicious traffic stopped.
This was monitored on my CDN Cloudflare by finding problem traffic on Analytics -> Security -> Threats by Country then setting a custom rule to block them on Securty -> WAF -> Custom Rules