How to identify a botnet on a local network?

Question

Malware

Good day!
Guests arrive at the hotel, some with infected computers, the provider called and said that a ddos ​​attack was coming from our IP address, how to calculate and how to deal with EVIL?
All guests access the Internet via wi-fi, the infrastructure is built on Mikrotik routers, RB951, RB3011, RB2011. Is there some kind of automated system that sniffs traffic for malware? Now captchas are
constantly flying out on any request to Google, Yandex and when opening sites.

Answer 1

Set proxies, force guests to taxi to them (via WPAD or manually).
On the proxy, limit the number of requests from each client.
Have several IP addresses from the provider: for official use, for guest use.