Thanks for the tip! I've been blocking the crawlers at the CDN level (they use Chrome as the user agent, with older versions between 100 and 150 - any "user" on those versions gets forced into a bot challenge)
This helped, but I've disabled public timelines as well. I've left the local timelines enabled to help potential new users get a feel for the server before they sign up.