So fix your backend to exempt Tor visitors from those measures, if it's really all due to hallucinating clusters of abuse from a network where abuse categorically does not appear in clusters of the kind that your backend is attempting to detect.

To add an exemption for proton.me: The list of Tor exit IPs is public. For the .onion: That's loopback traffic from the tor daemon running on your own load balancer or wherever you've put it.