If you have your site behind a CDN, you need to beware that many users may appear to the system as coming from the same IP address. If using cloudflare, there’s an alternative config file which sorts this out. Perhaps see
or How do I reveal real IPs using CloudFlare
I see I’ve set that to 999 - which isn’t infinite, but I don’t have a large site (or a spam problem)