Have you tried the Stop Spammers plugin
I have found that can be pretty effective - not 100% - but good at stopping spam registrations - you can add various APIs.
I don't think you can do the CSV thing you need specifically, but I'm pretty sure you can cut into your existing db - and prevent further spam registrations.
Side-note, I find CloudFlare is pretty good at protecting the sign up process from bots.
The plugin cannot delete existing users:
Unfortunately, WordPress did not record the IP address of User registrations prior to version 5.0. This is a design flaw in WordPress. They do record the IP of comments. I cannot run a check against logins without their IP address, so you have to remove users the old fashioned way, one at a time. You might try listing the emails of all registered users, and then deleting them. You can then ask all users to re-register, but that would probably annoy your legitimate users.