I analysed the access logs on our server and recognised that the most aggressive bots/crawlers are not detected by Cloudflare, i.e. they are not listed in the security analytics:
In the security analytics of Cloudflare, the top 1 bot listed is Bing, but AhrefsBot does 2.5x more requests and Amazonbot does nearly 30x more requests than Bing, and with this is the number one active bot on our domain, by far. Especially also for bot protection/blocking modes, it is essential that Cloudflare detects at least the most common ones, and currently the vast majority of bot activity on our domain is not detected as such at all.
It is not a problem for us, the server can handle it and we’re happy when Alexa users get information from our websites, so this is FYI and not a request for help or advices .