I think you're overthinking this. Just having a per (cloudflare) customer rate limit would go a long long way.