Kcfinder image loader is blocked but nothing in logs

Hi,
when we pause Cloudflare (CF) application works fine.
When it is on it produces error but it is not logged anywhere on CF.
I have disabled DDOS rules, page rules, managed rules, WAF IP rules, CF in developer mode but no change.
What else I can check but most importantly how could those access attempts get logged?

Thank you