False traffic in Google Analytics from New York - Bot?

We have had an issue for the past two months with a big amount of traffic from New York that is being picked up in Google Analytics but not in Cloudflare. This has now stopped after we downgraded our Cloudflare subscription to Pro version. Could this have been a bot and why would this traffic just show in Google Analytics and not Cloudflare?

There’s always the chance that it’s bypassing Cloudflare and directly hitting the origin server. Do you have a firewall set to block all traffic that’s not coming through Cloudflare?