Run them all through a converter into PDF/A format.
It forbids any sort of active content.
If they won't convert, trash them.
IDS/IPS with Anti-Malware license
Scanning is a losing battle. No matter what your scanner knows to look for, there will always be something new that it doesn't know to look for.
dedicated sandboxed cloud environment
That's useful for generic malware, but not useful for targeted malware that will only execute it's payload under conditions that only exist at it's target.
If you want to make sure the file won't do anything Evil when opened, make sure it doesn't contain anything executable. You do this by running the conversion to non-executable PDF/A yourself. This creates a new, clean PDF file that by definition isn't infected because you created it.
It is almost impossible to prevent upload of malicious PDF files since a script needs to be able to detect the malicious content. Someone could zip and encrypt a virus which can be saved in a PDF which would not be detectable by any analysis without the decryption key. An anti virus/trojan programme suite (eg Malwarebytes) should be run on the server to quarantine (including delete) any infected files found so they cannot do any harm after upload. You could block all uploads to be sure malicious content does not get through.