The same was happening on mastodon.radio.

I wonder if you can apply a fail2ban rule and block them before they hit the server again within a defined ruleset.

Essentially fail2ban matches against a log file, like a webserver log, then depending on the rules you set, creates an action like an IP firewall or something else, with the option of releasing the action after a period.

You can match on pretty much any aspect of the log, too fast, same action more than once, invalid URL, etc.