Given you have a very small set of IP addresses hitting your server I suggest you add deny rules on your public subnet Network Access Control List (NACL). It's in the EC2 console.
If it were a DDOS then AWS Shield (free) would probably have taken care of it, and if not AWS WAF may also help.
Yes, you can do that, and a similar example is even in the nginx documentation.
The access_log directive also takes an optional if= parameter which evaluates variables given to it, and logs only if the result is not 0 or an empty string. Combined with the fact that you can have more than one access_log in a level, you can log differently based on your needs.
It seems this was the better rule - stops the traffic before going over the GRE tunnel over the limit
iptables -t mangle -A PREROUTING -p udp --dport 30000 -m set --match-set blacklist src -m hashlimit --hashlimit-mode srcip --hashlimit-srcmask 24 --hashlimit-above 100/sec --hashlimit-name test -j DROP
-hashlimit-srcmask 24 - to group the incoming traffic ...