OP is seeing the proxied requests but looking at the wrong data. Should check X-FORWADED-FOR and create rules to stop it using the WAF provided. There is no "Cloudflare attack" going on.