It's not "quasi-judicial". They have no judicial authority, at all, despite how they present themselves.

They can only show them their supposed findings to a ministerial judge and tell them "Weeeh weeh, Cloudflare is being mean".

Then the judge will look at the AGCOM analysis, listen to Cloudflare or an EU representative or whoever may raise an objection to those findings, and then, after a loooooong time, enforce or not the fine.