My guess is your search rules are too vague/open. Before these hackers popped up you could get away with that, but not anymore. If the destination URI gets through some catch all type of search rule on the VCSE it will then send it to the VCSC trying to find the destination, and during the time it's trying that, it's using a traversal license on both devices. It will ultimately fail and free up the license, but if you're getting out of resource messages you are probably (almost certainly) missing legitimate calls during those times.
What you need to do is have search rules that are specific on your VCSE, especially any that have source "any". For example if your standard URI is a seven digit number followed by @ABC.com, then only allow inbound from "any" that match that pattern, and not anything else. With Regex this isn't hard to do. I'm sure you'll have more than one you'll need to add.
Most of your bad inbound calls are probably coming @ip address rather than your domain, correct? I doubt in this day and age you need to support @ip calls, so don't, make sure you don't have any search rule or transform to support those calls - remember transforms get applied before search rules, so check there.
