Spam clicks

I have a website that is getting spammed with clicks on adwords costing money along with just direct clicks killing the time on site. I’ve tried blocking those IP ranges on the website as well as blocking the locations on AdWords. It doesn’t seem like they are really producing results or preventing them. Any other advice or ideas?