As to Anubis, I noticed that bots seemed to be bypassing it. To understand the traffic, I configured Anubis to return a 499 status code to make it easier to grep in logs. And with that one weird trick, the bot traffic went away.

It's almost as if they told vibe-coded something to solve Anubis challenges and didn't bother to check edge cases. I can't see this one lasting for long though so I'm going to have to come up with something a bit more robust.