Comment by saluki

Cloudflare business level plan has upgraded DDOS protection that's a good first step to upgrade to even temporarily.

Block Thailand IPs. https://www.alphr.com/block-country-cloudflare/

Add honeypot form fields if it's a bot you can show success message but disregard the data and blacklist their ip.