During Dictionary Attack, how can I Capture the attempted usernames and passwords? I have several nefarious individuals attempting to gain access to my servers constantly with VNC, presumably using some kind of dictionary attack against the password.

Is there a way to get a log of the actual attempts being made inclusive of the VNC password or in this case the macOS username and password being attempted?

I can see the logged attempts at the connections in my firewall software... just not the actual data from the attempts by 45.115.39.125, 185.148.147.101... (the most persistent two).
I don't know an answer to the question you asked, but from an IT security best practices perspective: 

Run VNC on a local interface only. Use a key-based vpn or ssh tunnel to access the local interface remotely.

Is there a reason you need to run VNC on a non-secure interface?