Have you got contacts of them? If so, might be good to write them to allowlist your VPS IP address if you’re sending and fetching those requests from legally (in some respectable time-frame like every X minute or so, not every X seconds) 
Otherwise, try using cURL() for PHP if not already, change the User-Agent, etc.
How about using a headless-browser if so?
I am afraid it’ll be challenging to bypass Cloudflare’s security mechanism, if not impossible.
Depending what kind of data you do have from them, you could try via Cloudflare Worker to fetch the content (might be billed for such stuff, but …).