What are the python searches? Are they like bad bots?
Most probably just “bad bots” searching for potential vulnerabilities.
How do I block or prevent them?
Well, you are already serving a 404 by the sounds of it, so it’s really a non-issue. However, you can prevent the request from going through WordPress by blocking the request early in .htaccess, as you are already probably doing.
For example, at the top of your .htaccess file:
RewriteCond %{HTTP_USER_AGENT} python [NC]
RewriteRule ^ - [R=404]
The above sends a 404 Not Found for any request from a user-agent that contains “python” (not case-sensitive).
However, blocking by user-agent isn’t necessarily that reliable since many “bad bots” pretend to be regular users.
I found an older (2017) resource with some code to block them by User-Agent in my .htaccess file, which I implemented but it does not seem to be working – I still see logs of those bad bots
If you block the “bad bot” in .htaccess you will still see the request in your server’s access log. However, the log entry should show the HTTP status as 403 or 404 if it is blocked.
The only way to block the request entirely from hitting your server (and appearing in your server’s logs) is if you have a frontend proxy-server / firewall that “screens” all your requests.