BruteForce

Just received a warning from hostgator.com, “Your account has been abusing CPU resources for an extended period of time.” My suspect and confirmed by hostgator that the CPU abuse is due to bruteforce login:
>> 195.154.242.151 mywebsite.com/wp-login.php <<

My BruteForce setting even before receiving the warning from hostgator:
Rename Login Page – Enabled
Cookie Based Brute Force Login Prevention – Disabled
Login Form Captcha Settings – Enabled
Login IP Whitelist – Disabled
Honeypot – Disabled

How do I fix this? Admins don’t log in via /wp-login as we’ve renamed our login page several months ago already.

Please help.

https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/