I've had similar issues for my site AppGoblin. I offer 1000 daily free API calls and have had rashes of various bot like activity signing up to use the free API calls. In the end I had to add CloudFlare inbetween the signup process, which is a huge pain as I know that blocks many normal people on VPNs or in smaller countries.

The bot users I found were never particularly sophisticated, using certain name or email elements that were similar and semi obvious. Still, they came from all different domains, many with realish looking vibe coded sites that only looked faked once you really poked around (no contact, or no linkedin, extremely vague, no more than one or two pages etc). And of course the most obvious thing, that one or two I wouldnt' think much of, but seeing 12 similar name/site/email combos in a day and you realize it's coordinated.