aCstudent on "200k visitors/bots? How do I stop it? Does it cause problems?"

Dear nathanvj,
This traffic is annoying, and ruins your Google analytics analysis. If it really is a hacking attack, it can slow your users access times.

The default settings on Wordfence need a bit of tweaking IMHO. Within the paid version, you can block IP addresses from particular countries, eg. Moldova, Russia, China.

You can also block traffic from IP addresses that appear to be trying to hack your site. I block the IP address of any traffic trying to hack the site for 30 days, not the 5 minutes, which I think is the default.

It might be referral spam, it is worthwhile checking out Google analytics to see if these visits are referrals. You can block domains generating referral spam in the .htaccess file. There is also a plugin for Google analytics that filters known referral spam.

Good luck