@mike805 if you find it useful, I use go-away (https://git.gammaspectra.live/git/go-away), rules ramped up for checks on blog posts that usually cans out the bots. On the firewall I also pull a blocklist from AbuseIPDB.com, for the most part it will catch scrapers in the net.

I've not yet worked out a way to calculate failed challenges for an IP then report them in to AbuseIPDB from go-away to rat on them