To limit its chances of success, make sure your users' passwords are strong and all security patches are applied on time.
From your description it looks like a simple automated brute force activity trying to break into your system in some simplest scripted ways. This on the Internet is roughly equivalent to white noise in radio transmission. It's always there in the air, always present, but as long as it doesn't prevent you from listening to the music, this is fine, more or less. You wouldn't even have noticed this if not for a recent unfortunate event not connected with this particular activity at all though.
On a /19 IPv4 network, I can see hundreds of similar attempts coming towards different IP addresses every minute. Those attempts are mostly automated, bots are trying a few simple passhrases and also a few popular exploits (hence patch management on your side) across the whole IPv4 address space. If the rest of your security policies are fine, you won't see problems with this alone. If you do have problems with security, rate limiting won't help you for long.
If it's not an automated activity, then a motivated attacker is able to use much more than a single IP address at a time and won't get fooled by any sane rate limiting. Some brute force bots are already issuing their requests once in 10 minutes or even less frequently. You can't allow just one authentication attempt in 10 minutes, an ordinary user will be upset with that.
Having said that, popular HTTP servers allow you to set up rate limiting in the configuration file:
Limiting authentication attempts to a rate close to 15r/m with some reasonable allowed burst may be a good idea.
There's also probably something wrong with either the activity log plug-in, or the reCAPTCHA plug-in, or the way all your plug-ins communicate with each other. Make sure the reCAPTCHA plug-in checks the CAPTCHA response before allowing to process the rest of authentication.
It might be also a good idea to do CAPTCHA checking only at account registration and to use MFA for authentication, it's more reliable in your case and would probably have helped you with the previous incident.