How to minimize traffic bot from ISP

Bot traffic from ASN hosting / cloud companies can be JS-challenged. Tell me how do you deal with non-human traffic from ISP that use common user-agent? It affected conversion reports badly, but I can’t bear to block them just because of a few bad apples. I know Google Analytics & Cloudflare have tried their best but seems the problems are always bigger.

Yesterday I tried to JS-challenged all traffic for 24 hours, with some exceptions like exclude my hosting provider ASN, known bots, and some UA I allowed. The result, I got only half the traffic than usual days. Again, can you share anything you’ve done, best-practiced to prevent bot traffic from ISPs? I can block the IP addresses but there are too many.

Thank you.