Try running some of the IPs through a proxy detection API like https://ipinfo.io/products/proxy-vpn-detection-api or https://proxycheck.io/

You can't trust those services 100% but you can use them to turn up the level of turnstile/captcha/verification on those clients.

I'm somewhat concerned that you don't know what you'd be looking for (or to verify Tor) if you're running an ecommerce platform, fraud is an almost certain outcome for any store and merchant providers (Paypal, Stripe, Adyen, etc) want zero to do with helping you solve that (even if you're only embedding their Javascript!)