Card Testing Attack

I'm having a card testing attack take place on two separate sites that I manage. I've tried v3 and v2 recaptcha and that doesn't stop them. I've set it so there's no longer guest checkout and they just make accounts. I've added Wordfence (free) and that hasn't done anything. The IP addresses are completely different every time.

There aren't that many of them really. One site has had about 240, and the other only about 30, and that's across a few weeks. On the site with 240, they'll stop for 12-48 hrs and then have another flurry of 30-40 orders across the space of multiple hours.

They all sign up using an email in the format [name].[random six digit number]@gmail.com, if that can be used for anything.

Any idea on what to try next?

UPDATE: As some people have suggested in the comments, it was seemingly down to the PayPal advanced card processing. I switched to standard card processing and have yet to have any further spam orders.