I worked with Alexey on this project. It’s pretty straightforward to filter out bots (either before send, or in analysis later). For our traffic, it was mostly commonly known bot user-agents. I’m also pretty sure malicious bots get blocked by Cloudflare before hitting the Cloudflare workers.