200 IP addresses per hour isn't that much.. (I have 300-400 per hour). Loads of search engine bots and vulnerability scanners are continuously scraping the entire web. If you are concerned about traffic consumption or them slowing down your server or otherwise want to lock them out, then inspect the Apache log file and find common criteria to forbid access in .htaccess using SetEnvIf Remote_Addr ... and Deny from env=..., or RewriteCond %{REMOTE_ADDR} ... (and/or any other condition) and RewriteRule .* - [F,L]

If it's only about bot IPs appearing in the stats there's also [extension by plg] No Stats For Robots that might exclude some known bots (my 300-400 are already without those).

Also, GeoIp blocking probably wouldn't help at all (as you noticed, they are from all over the world) or rather may be harmful because it would block innocent people as well.

There are some continuously updated IP block lists against reported malicious IPs available on the net, for that you'd have to install some service or such and talk to your hosting provider. See for example https://app.crowdsec.net/cti or https://www.abuseipdb.com/ or https://www.ipvoid.com/ip-blacklist-check/ for examples.