Does cloudflare block the traffic as close to the end user as possible? Curious if this is a case of "blocked traffic still uses a significant amount of their resources" or just a billing software limitation.
The firewall logs for the blocked traffic show it is all being stopped from a single PoP in France. I think this is just a billing limitation but one that might have been put in place on purpose. I honestly hope they change this soon as others are bound to experience similar scenarios.