Thank you Nick.
I am running ClearOS mail server.
I am assuming the IPs aren't connected as the spam is intermittent. So when the reconnect would happen it should block but it doesn't.
Is there a way that I can check?

I'll look into the ipset. I'm always looking for ways to be more efficient. Thanks again for your help.