Your game has vulnerabilities, start by fixing those. An exploiter should never have enough power to cause harm.
I think the Roblox ban system is based on IPv6 checks that are often influenced by a device mac address. Therefore if an exploiter changes their device mac address, which is totally free and costs nothing, they can change their IPv6 and evade the ban.
The most obvious one is fix the problems they take advantage of. However if you really want to track them you can add your own fingerprinting system above the Roblox ban system. For example checking os related information, values from UserInputService, table addresses to determine if they use 32 or 64 bit clients, client versions, and the list goes on.