> Cloudflare is non-stop never ending traffic. I don't know WTF they are trying to get. I've also seen TCP queries from those same Cloudflare IPs

1. Breach router or desktop that hasn't been patched in ages via mass script

2. Establish C&C using cloudflare tunnels

3. Sell these hacked systems as residential proxy endpoints to everybody from state actors to teenagers

4. Some of them will be data scraping services

You are chasing your tail trying to ban by ASN or IP. It may work for another couple of months, at best.