Always appreciate you, thanks for the answers. Seems like you have a pretty good solution going at least. So temp IP blocks only when many fresh pubkeys coming from one address. Could still cause issues for VPN users as you pointed out but at least better targeted. 

Our problem is we don’t have any IP/network info on our aggregator so we have to make decisions based on only the events. I think the new system will work though.