Even if you actively monitor new handshakes, deauth frames and rogue AP in wireshark to identify the attack, you still can't prevent attacker to initiate KRACK on your clients.
Actually changing the PSK and ask your clients to disconnect once you identify the attack is helpful to the attacker and not for you because attacker is also monitoring the handshake and you are giving him an opportunity to block message 4 of the handshake.
Once message 4 is blocked, the AP will resend message 3 and nonce will be reset. In case of Android and Linux using wpa_supplicant v2.4/2.5 the Temporal Encryption Key also set to zero encryption key.
Changing PSK will automatically ask your clients to reauthenticate and now attacker can intrude in the handshake without making any efforts to deauthenticate your clients.