Best practices for blocking bad bots?

Good morning, I'm facing a lot for bad bots which crawl websites on my servers and submitting contact forms/newsletter forms of my customers. Even if my customers can block them with captcha tools on their form, I'm asking if there are some actions that I can do on my servers to block them (except IP blocking, which is very hard to manage as the bots doesn't have any fixed IP, they run on compromised servers across the world I think). I'm currently trying with Comodo WAF rules, does it help? Thanks in advance.