The bots might be run in the datacenter and proxied through residential IPs as the exit point.
If they are, then that wouldn't be YANDEX AS13238. So the linked graph wouldn't show these changes.
You won't see this kind of stats on the CF page.
All it shows is direct traffic against CF infrastructure.
If they are, then that wouldn't be YANDEX AS13238. So the linked graph wouldn't show these changes.