In general on lower plans, Cloudflare only provides tools to protect against layer 7 DDoS. IP reputation only does so much, if you are a high enough value target to get hit with completely fresh and good-standing IPs, CF can’t help.
If under attack mode isn’t working, maybe try a firewall rules set to “challenge”.