I just wanted to mention that I finally installed Anubis in front of my Composr v10 site last week, and so far, it's working absolutely phenomenally at blocking these bot requests (and keeping my server online). I've gone from 150-200 active users at any given time to less than 10. Additionally, it appears at least Google and Apple bot requests are still making it through to my website, which was a concern keeping me from using Anubis for a while (and I might tune for additional "friendly" indexers in the future).

I think the optimization these botnets are forcing in Composr might actually be a good thing in the long-term. But short-term, I wanted to offer that as another mitigation option to look into in addition to Cloudflare. Lots of other FLOSS development communities are using Anubis at this point in time (although more for their source code repos/issue trackers/etc, and not necessarily for just their homepages).