Do I need site cleanup?

I have the free version of wordfence on 2 sites. One suffered a brute force attack but not for the logins. They tested the site and made 5 successful suspicious purchases. I saw these and put the site into catalogue mode, but after I did this we started to get 37,000 cancelled transactions. they managed to bypass the catalogue mode and process this is 2 hours. None actually went through. My host has scanned and said the site is clear of viruses. But the theme support said this is ony way they could bypass the catalogue mode….so I don’c know if I need the site cleaning service or not. ALSO would the premium service of wordfence protect me against this type of attack?

The page I need help with: [log in to see the link]