I recently, with great reluctance, had to put a personal site behind Cloudflare free option. It gets lots of use, but brings no revenue (costs me to run) and I have little spare time.
Found out that I was blocked from it in my default setup. Firefox with default settings, and no VPN.
I'm working hard to turn Cloudflare off.
Cloudflare is not remotely awsome. It's also a solution to a problem (aggressive scrapers that produce DOS) which is worse.
What malicious usage are you seeing? You might have a lot more usage than me, but fail2ban has been enough