You need a firewall that tells you the IPs where the attacks are coming from and block them. In addition to blocking certain countries that you know are not your users. An aspiration system would also be good for you, but it is more complex. Anyway Cloudflare is a patch in a very big hole in your raft, it only works for web that I know.
I also admit, that maybe it is not prepared for so many users.
if you can't understand me... I don't know English, sorry
like(1)