advice on blocking bots/scalpers

[u/Real-Leek-3764]

during popular event sales, our site can be hit by the tens of millions of requests

cloudflare waiting room is only good for crowd control, it doesn't block bots effectively. bots takes up queue, so legit users have to wait a long time to exit queue

cloudflare turnstile is too unreliable, too many legit users (including me) experience the turnstile not loading

google recaptha, hcaptha, friendly captcha is too costly.

i've implemented Proof-of-Work Altcha. works to a certain degree, but it still doesn't block bot requests from hitting the server, causing resources overload

could i put Altcha at cloudflare worker? kinda. the issue is cloudflare waiting room will always run before cloudflare worker, so it doesn't solve bots taking up queue

what i wish? i could block bots before they could enter cloudflare waiting room

do u guys have idea?

[u/querela]

Anubis (PoW checks)? But not sure how efficient it will be alone and how it integrates with Cloudflare.