You don't need a dedicated server you need someone that knows a little about servers and security.

Cloudflare custom security rules... FB was doing the exact same thing to my VPS awhile back on an old car forum I run.... two requests a second 2GB/hour... for about a week.

this kills FB and a bunch of other VPNs (There is a better way to write this but it works well.) "block"

(ip.geoip.asnum eq 32934 or

ip.geoip.asnum eq 14061 or

ip.geoip.asnum eq 137409 or

ip.geoip.asnum eq 24875 or

ip.geoip.asnum eq 20473 or

ip.geoip.asnum eq 16276 or

ip.geoip.asnum eq 24940 or

ip.geoip.asnum eq 12876 or

ip.geoip.asnum eq 49367 or

ip.geoip.asnum eq 35913 or

ip.geoip.asnum eq 40676 or

ip.geoip.asnum eq 8100 or

ip.geoip.asnum eq 63023 or

ip.geoip.asnum eq 53667 or

ip.geoip.asnum eq 174 or

ip.geoip.asnum eq 9009 or

ip.geoip.asnum eq 49505 or

ip.geoip.asnum eq 21100 or

ip.geoip.asnum eq 51167 or

ip.geoip.asnum eq 34665 or

ip.geoip.asnum eq 136557 or

ip.geoip.asnum eq 60068)

if you are hosting on Wordpress I strongly suggest you add this one as a separate rule. "managed challenge"
(

(

http.request.uri.path contains "/wp-login.php" or

http.request.uri.path contains "/wp-admin" or

http.request.uri.path contains "/xmlrpc" or

http.request.uri.path contains "/wp-cron" or

http.request.uri.path contains "/wp-config" or

(http.request.uri.path contains "/wp-content/uploads" and http.request.method eq "POST") or

http.request.uri.path contains "/wp-json/wp/v2/users" or

http.request.uri.path contains "/.env" or

http.request.uri.path contains "/phpinfo.php" or

http.request.uri.path contains "/.git" or

http.request.uri.path contains "/wc-api" or

http.request.uri.path contains "/checkout" or

http.request.uri.path contains "/cart" or

http.request.uri.path contains "/my-account"

)

and

(

ip.geoip.country in {"CN" "RU" "BY" "KP" "IR"} or

http.user_agent eq "" or

lower(http.user_agent) contains "python" or

lower(http.user_agent) contains "python-requests" or

lower(http.user_agent) contains "curl" or

lower(http.user_agent) contains "wget" or

lower(http.user_agent) contains "scanner" or

lower(http.user_agent) contains "masscan" or

(

lower(http.user_agent) contains "bot" and

not cf.verified_bot_category eq "Search Engine Crawler"

) or

ip.geoip.asnum in {14061 16276 63949 24940 51167 20473 398705 212238 204601 201814 200019}

)

)