My first thought is, "Why would it benefit your company, unless you were dealing with payments directly?," and then I read your comment history and it all makes sense now, haha.

Honestly, for assessing risk of individual users, my worry is that the only good option right now is to use tools that require lots of data on the user, like recaptcha v3. You could set up a honeypot that tries to catch as many IP addresses implicated in proxy activity as possible. Maybe that second one would be a good company idea.