Bots are attacking my website creating 1,000 of BOGUS members.

I have a security problem. I have a (gay) social media website. Anyone can go there and fill in a membership registration form to become a member. I used to have my system set to automatically approve membership as soon as the person verifies their email address. However, bots began filling out registration forms, about 1 each minute. I noticed they (1,000s of them) were all from the Russian Federation. So I set my software to block all people from even seeing my site. That lasted about 10 minutes because they changed location be from Latvia. I then blocked Latvia and they use another country. So the idea of blocking them by country will not work. You may ask why they are doing this. To create as many memberships as possible (many 1,000s ) and once an official member, each of them can send dozens of emails to other (random) members which direct them to register at another site, this is another gay site. So they are trying to harvest my members. As a temporary measure, I set “approve” to be manual so I will personally approve or deny. In terms o9f anyone from the Russian Federation or any Russian block country, I simply delete their form and they never become a member. In other words, they can fill in 1,000s of registrations, but they can not be members. Then the problem is to spend a lot of time reviewing and deleting 1,000s of reg forms. What a hassle. And I need to do this continually, every few hours. I believe part of this attack is by human hands since each registration must complete a Captcha, which I have and it is working. So a person must be “assiting” the bot to get passed it. Now, I took a drastic step and temporarily prevent all registrations, including the real people who would be real members. I had to stop all new members from joining. Question is: How to stop these attacks. I cannot block the IP address, because each bogus member has a different IP address. I can not block them by country, because they only change to a different country location. And I already have a Captcha working. Have worked to stop this kind of attack? I am only interested in coders who have successfully stopped these human-assisted bot attacks.