Is your DNS on Cloudflare? Their network will proxy requests to your domain even if you don't use their proxy service. You have to add a WAF rule to prevent this (I also got DDoSed this way).