We do something similar, but a bit more complex with around a million "failed" (HTTP 4xx/5xx) requests each day from all over the site, not just forums
Kafka -> enrich -> add geo, ASN, history, request headers -> analyze -> look at class C, ASN, request patterns, request rates, payloads -> act...