Cloudflare explicitly says that PAT is one signal in its challenge decisions, not an automatic bypass.