Many thanks for pointing me in the right direction.
I found out that in “Events” :
Mar 3, 2025 10:09:41 AM - JS Challenge - Tor - 192.42.116.210
Mar 3, 2025 10:09:30 AM - JS Challenge - United States - 66.249.68.38
The first one seems to be the spam bots. The second one seems to be the legitimate Google indexing request.
So I adjusted the rule :
(starts_with(http.request.full_uri, "https://boudoirphotography.mu/booking") and ip.src.country eq "T1")
An update to my issue. After a few hours the spams through my booking page started again.
There were only a few but same ones as before (I can see through the mail received i.e same subject lines).
I found the option : Security > Bots > “Bot Fight Mode” so I enabled it.