Hacker News Reader

The bots might be run in the datacenter and proxied through residential IPs as the exit point.

If they are, then that wouldn't be YANDEX AS13238. So the linked graph wouldn't show these changes.

Maybe they do use an obvious IP from yandex datacenter IP range so that you believe they can't possibly be yandex's bot?

You won't see this kind of stats on the CF page.

All it shows is direct traffic against CF infrastructure.