Are they all coming from 1 IP block or from everywhere?
There are ~200k records with IPs starting with 255.255... and a random (not 8333) port number - these were advertised 15+ hours ago.
But the more recent ones (~500k of them) seem to be completely random IPs with port number 8333
Banning the whole subnet with
setban 255.255 add $((60*60*24*14)) # two week ban . A two week long ban should be enough to see the wave of addresses die out as whoever's doing this probably won't be able to sustain their nodes for that long. But if you have a way to extract records from peers.dat then you can contain the bad addresses better.