We don't necessarily know if a given IP address is a VPN server - only that it's likely judging by the user's behavior, and the fact that some of them are publicly known as such if you look them up on teh interwebz

VPN IPs are often in blocks, and an attacker will rapidly hop from 123.123.123.8 to 123.123.123.63 to 123.123.76.89 and so on - and they'll keep using that particular VPN server (or whatever) until they can no longer can. In the frantic attempt to mitigate the attack as quickly as possible (which - depending on the severity of the attacker's mental illness - can go on for hours and be repeated daily for weeks/months) we'll just ban every 123.123.* address for 9001 days and make sure they cannot use whatever address/range they were using again

To give you some perspective: on 2025/06/25 we had a spam attack that resulted in a total of 87 posts across the various koko boards being deleted, and 87 mutes/bans/rangebans being made. That was a single day out of the 3 years I have been volunteering to moderate this site, and is far from the worst attack we've ever had - in fact it only lasted an hour and the user was relatively slow about it, while many other attacks we've faced have consumed significantly more of our time