A good old Honey Pot helped us at All Quiet "a lot" with those attacks. Basically all attacks are remediated by this. No need for Cloudflare etc.
Honeypots work until the bot starts posting to every field. Dropping traffic scrubbing also means you lose the abuse reporting and IP reputation feed that a service like Cloudflare gives you, so a trick that filters one class of signup spam turns into you handling the rest of the mess yourself.
Can you expand on that? A separate honey pot sign up page invisible to real users, or something else?