Did you checked for any Firewall events under the Security tab → WAF → Overview?
It should provide you the information which service did blocked that particular IP. It could be like Managed Rules, Firewall Rule, Browser Integrity Check, Bot Fight Mode or some other security related options at Cloudflare dashboard.
May I ask if you did tried to troubleshoot if maybe the origin host/server is returning 403 from the origin host/server?
