Same here. Have a small gitea instance with cloned projects from github I‘m keeping in case the github version gets removed. Every few days there is an army of bots hammering my small vm with 40k req/min for 20 min straight. I had to install anubis to keep the instance online (while still slowed down).
I don't even have anything worthwile on my gitea instance, and the same thing happened to me.
The only thing that ended up helping was disabling access for anonymous users.