Do they filter by prefix to stop geographic areas? I did block some Amazon scanning on an e commerce but taking down few ip's was enough to stop the waste of resources.

I tested about the VPN's and they just have updated lists of common VPN addresses. Using a custom VPN make them unable to filter so there shouldn't be any other sign that tells the server who's using the VPN. Perhaps a discrepancy about DNS servers use or some other leaks.