You can have it both ways: use CloudFlare and offer direct access through a hidden service (since DDoS attacks over Tor are impossible, expect for application layer attacks).
What purpose does the cloudflare captcha serve in that scenario?
And lots of people who aren't Tor users also have to suffer through the captchas every time they visit a CF site.