More than a Month now our website has massive spikes in direct traffic. So my thoughts are spam. I discovered a lot of traffic from certain cities, especially Boardman, Montreal, Columbus. What is the best approach in GA4 to exclude this spam traffic?
Well, GA4 is a way-way lower quality, but also cheaper (for Google) to maintain compared to GA UA. They got rid of the view filters with the whole concept of views. So in short, there's no easy way to filter the bot traffic out.
The easiest remedy is probably just to add country filters to your exploration dashboards (you're not supposed to reliably use Reports any way).
More advanced solution would be an ETL solution: exporting the data to BQ, sanitizing it there with SQL and then loading it to whatever datalake you like and use a real BI tool for analysis instead of GA4 interface.
Even more advanced solution would be hiding your collect endpoint by shifting your tracking completely to backend GTM. That way, spammers won't even know where to send their spam.
I suggest going with the simple Explorer filter solution. Or just doing nothing. The spammers will stop doing it eventually.