The rate they try becomes very non frequent when they use multiple card validation apis. I'm not sure how it can be related when it's different pan numbers, different source ips etc.

Enumerating CVC2 with a single PAN is a different story.