Is your website a WordPress website ? You said "no" in your comments.
So there is no threat of successful login to your "WordPress" login page !
The only threat I can see in your case, is the resources that these bots are consuming, which could be increased by a
200 OK response for your fake
/wp-login.php , and the worst scenario is that these scanning bots continue to scan your domain till they find another vulnerability.
If your website is not a WordPress website, I think the best solution is what SO does by redirecting them to another server that can handle load like youtube.
Or if you want to be more aggressive, On my non WordPress website I block any IP for 24 hours that requests these pages like
/wp-login.php, I know my small site well and I have no links to
/wp-login.php, and I'm sure that whoever requests this page is a scanning bot, so I block them for a while.