Hi, I run soyjak.party and we're facing a similar situation.
Since around late September, we've been dealing with an individual attempting to use spambots to flood the site with CSAM.
Usually this wouldn't be very noteworthy as imageboards are a common target for botting and CSAM spam. However, this particular spammer is extremely persistent, seems to dedicate all his waking hours to this, and keeps trying in spite of captcha updates, elaborate autoban filters, having the post endpoint respond with zip bombs upon detection to waste proxy bandwidth, etc.
He also has ties to Leto:
Shortly after I enabled our in-house captcha for first time posters to counter the spambot, I noticed
this github account (
Archive) start asking for help with automating it:
QIN2DIM/hcaptcha-challenger/issues/1072 (
Archive),
moffatman/chan/issues/280 (
Archive).
The second issue is particularly interesting as he brags about botting 8chan in the past and links the
github repo for that bot (
Archive):
This repo has a
single issue (
Archive):

Somebody who went by "Leto#5688" on Discord in 2022 asking our spammer to add him on Discord.
I went through
his github profile (
Archive) and sure enough, this seems to be the same Leto as the one behind 4chan.gay.
Lots of issues opened by him asking for help with evading the same type of browser fingerprinting employed by 4chan's anti-bot measures, as well as
this issue (
Archive) offering to help integrate 4chan.gay support into a 4chan mobile app:

So given this connection to Leto, the similarity in tactics, and the timing, I think we're probably being attacked by the same people.
Being an imageboard without accounts, "closing the gates" like you isn't an option for us.
Instead we've been using an in-house browser fingerprinting library to detect and autoban his bots along with manual media approval as a fallback for when he manages to slip past the automated defenses.
It's an ugly game of cat and mouse where I'll update the fingerprinting or captcha and he'll be held off for anywhere from 0.5-72 hours then figure how to bypass it and go back to spamming the approval queue with CSAM.
I also notice the site gets heavily DDoSed if whatever I changed manages to hold him off for more than a few hours.
Thankfully this is all practically invisible to regular users aside from the bans page being full of bans for "11. - You WILL NOT use any sort of bot to automate posting on the site." at all hours.
I assumed he'd just give up after realizing the site's users were never going to see his spam but it seems the goal is to traumatize the moderators:
For now my plan is to just endure the cat and mouse game until he gets bored. I have a couple ideas that might stop him permanently but I've not had time to implement them yet.
Attaching a txt file with archive links to everything on his and Leto's github accounts in case they delete them after seeing this.