It seems Special:CreateAccount is still enabled even though the link at the top right is to Special:RequestAccount. Obviously, bots don't click the link, they just go to the relevant page (or use the createaccount API).

I notice on MediaWikiWiki:Extension:ConfirmAccount the following warning:

For MediaWiki 1.35+ there appears to be an issue with permissions when using wfLoadExtension(): the createaccount permission may not be revoked from the all users group. Use $wgGroupPermissions['*']['createaccount'] = false; to prevent account creation until this is resolved.

    If you want the bureaucrats to be able to accept new requests, you need to set the permission explicitly: $wgGroupPermissions['bureaucrat']['createaccount'] = true; to enable them.)

Indeed, (all) still has the createaccount right and while the InviteSignup LocalSettings block sets the group permission to false, the equivalent block for ConfirmAccount does not revoke createaccount for *, nor permit it explicitly for bureaucrats.

Not directly linked but potentially also an issue to bear in mind: per T168783, the captcha used on Special:RequestAccount may not be verified until 1.40+ (unless you use the updated version in master, which the extension page suggests is not compatible).

For cleanup, I copied the User: namespace page list and dumped it into Special:DeleteBatch to clear out the ones that existed already, since they were past the recent changes limit for Special:Nuke.

I have the same problem here: https://lexbib.elex.is/wiki/Special:Log/newusers , where yesterday and today new spammer users have been created, despite "accounts must be requested" option in wikibase cloud dashboard being set to "on". In Spring 2022 there was another time frame when spammers got in (that seems to have ended in April). The dashboard option was set to "on" all the time.

https://github.com/wbstack/mediawiki/pull/305

This issue appears to have been resolved in that the account creation has been prohibited and no new accounts have been created since the afternoon of December 12.

There is now the separate issue that a lot of requests are getting through spam filters and clogging up the list:
44 open email confirmed account requests are pending. Your attention is needed!
prospective authors (open requests [185]
But the issue mentioned here appears resolved.

FYI: I created a followup ticket to figure out what to tweak to reduce the spam that's taking place: https://phabricator.wikimedia.org/T327176
Needs further discussion to figure it out, but it's on our radar as a followup of this ticket. This ticket can now be closed.