That IP is not used by Cloudflare when sending requests to origin servers. Instead, it seems to be an IP assigned to clients using iCloud Private Relay from Seoul, Korea (2606:54c0:3f20:a0::/64,KR,KR-11,Seoul,). To me this sounds like someone is sending requests directly to your origin, bypassing Cloudflare. This also suggests you aren’t blocking requests from non-Cloudflare IPs like you should