Ouch, that's just so annoying. Maybe some sort of human challenge for anyone that's not authenticated whenever the server load is high could help?...
Edit: unless the scraping is coming from the ActivityPub protocol as a bunch of instances trying to federate (or something? I'm still not familiar with how it all works, besides the payloads looking like a bunch of .json), in which case, my suggestion probably wouldn't apply all that well.