Syscalls and kernel module loading can both be logged, I assume that's sufficient here.

Yes but I am interested in hearing about cloudflare's implementation, how they scale it to their whole fleet, and what kinds of heuristics they are using to classifying behavior as anomalous.