Have you tried Anubis or similar tools? I've had similar issues with bot scraping of a forum taking all server resources, and using PoW challenge solved the problem.
Edit: To answer my own question, yes: http://www.arijuels.com/wp-content/uploads/2013/09/JB99.pdf
Edit 2: Maybe TLS would be another reasonable place for it?
I will say one very appealing use of Anubis I'd love to try is using it as a Traefik middleware to protect services running in docker containers.