IP intelligence prevent attack in level of IP, You can find categories of IP intelligence in link below,
Usually you need to stop the spam category as a lot of ISP providers change the customer public ip addresses and a spam ip address could now be attached to a legitimate customer. Change the category to logging and see if I am correct as I need to make this category in logging only not blocking mode.
If you got your answer please mark the reply that solved your issue as a solution. Thanks in advance.