Spoofing active TCP connections is extremely unlikely, either they are coming from these IP addresses (botnet f.ex) or you have a misconfiguration issue that allows attackers to trick the webserver (X-forwarded-for header f.ex)

Thanks Steffen. I didn't know about these botnet services. This could definitely be what they're doing.

One guess at the motivation is that they are building their own database to sell elsewhere.

Rather than a per-IP limit, you could require that they create accounts, and rate limit based on that. Be honest that, due to bots bypassing your Captchas, you need a valid email address, and that you're blocking registration from the email providers that you see the most spam from, such as mail.ru. (Similarly, if I were in Russia, with an ad-supported lookup site for Russian telephone numbers, I'd block gmail.com rather than mail.ru.)

Added bonus: You can have an ad-free option for accounts that pay a monthly fee, and tiers for easing the rate limits.

@FireQuacker That's my thought as well, a free service that can be relatively easily abused to mass obtain data that can be sold for advertising purposes could be a potential reason. They don't have to do the costly lookups themselves, and they can get some profits from it.

Scraping services will provide a bunch of IP's for you to run your distributed scraper against.

Considering that you are using reCaptcha, are you sure that the alleged attacker is attacking you with a botnet instead of a human farm?

How does your service exclude EU nationals or otherwise comply with GDPR?

They might be going through something like Tor.

Are there any patterns about the requests at all? Are they asking for a certain area?

If I had to guess, I'd say that the scammers might want to send mass SMS messages via the email-to-sms gateway, and then using that to spam people with SMS messages or maybe just scam them. You might try putting the answers in obscured images as well rather than plaintext, though they might be able to OCR that quickly. I don't know which site you're running, but I tried freecarrierlookup.com, and I got the same question twice in just a few lookups. This would be an example of having far too small of a database, since you can just solve all the captchas.

If you're really having trouble, I'd try to just play the other side of the fence and hack your own site. Maybe you can't get lots of IPs easily, but you can test just trying to hack your own captcha. Many of these captchas have severe flaws (leak information for instance about the answer) from what I've read elsewhere.

if you can really detect the bots, from the legitimate users, I would return invalid results that look good

What you're running sounds like a great service that would be very useful. If it works in the UK, would you mind providing a link?

I found your site. Your captcha is way too easy.

Look into geetest and binance's puzzle captcha

Likely they just use proxies.

How much does each query cost you? Also, would you be willing to share your source on your website? (I ask because I assume that an attacker who's willing to spend money to mine your data would stop attacking and just buy it directly if they know how and it's cheaper/easier that way. But the economic trade-offs seem to depend on how expensive it is for them to buy the data directly vs. mine it from your site.)

After reading through all the answers, one thing most of them miss and which you might consider is that maybe the bots are completely bypassing your captcha entirely. Programming errors or mistakes in your site could allow them to obtain the relevant data without solving the captcha. Since you've tried multiple captcha services, I suspect this is very likely. Everyone else already covered the other details, not putting this in an answer cause there's so much clutter already.

@Thomas - you should probably write that into an answer instead of a comment.

@Thomas this was my first thought as well. Perhaps it is only checked client side, or the server doesn't really enforce it.

Is the site hosted, or have you control over Apache configuration?

For an example of @Thomas’s suggestion, more than once when my valid e-mail address was rejected by buggy JavaScript, I examined the HTML form and hand-wrote the URI to send the needed parameters.

Question: Can you tie requests to major service accounts? IE: Facebook, Google, Twitter, etc? Make them log in through a third party portal and limit requests based on those accounts? Now they have to create accounts, log in and THEN break your captcha... you also now have accounts that you can use for those who wish to use your site heavily - paid services (if that's a route you want to go)