Persistent brute force attempts

I am using AIOWP and love it. Just one of my web sites is getting a persistent brute force attack. I have it set to lock out for an hour after 3 tries and I have a long random password so the chances of the attacker guessing right is slim. But it is annoying. Not sure what else I can do to rid myself of this.

1. I have changed the login page name
2. I do not have an account name of admin
3. Surprisingly, the attacker is guessing my user name correctly (my known name), presumably by deduction from my presence on the web site. I want to keep my user name for other users’ convenience. From this I deduce that it is the same attacker (or same attack bot each time.
4. Each attack comes from a different IP address, so I cannot forestall them that way.
5. I cannot restrict logins to be only from a known IP address because of various legitimate logins
6. I have turned on the honeypot to no effect
7. I have the built-in CAPCHA turned on

Yet still I am getting the ‘A lockdown event has occurred due to too many failed login attempts or invalid username:” message 2-3 times a day. It’s been going on for weeks. I imagine that a filled-in honeypot or wrong CAPCHA still counts as a failed login and hence towards the count when the lockdown occurs.

What more can AIOWP or I do? Any advice appreciated.