If I use an alternative login (e.g. CAS or other SSO) plugin, is my site protected from the recent brute force login attempts?

If CAS is the only login method, I think your blog should be protected. But, the atackers don’t care about alternative login methods. They simply send request against wp-login.php.

So if you still have an account named “admin”, CAS cannot protect your blog. Let’s think about the worst case. Assuming you have an account named “admin” with the password “1234”, but you use always CAS to login but with a different admin account. The attackers still can access your blog through wp-login.php and can get access.

You can try to rename the wp-login.php and test if everything still works. If it so, fine. If not, you have to protect your blog with other additional methods (like login löockdown).