I’d like to consider the Google Translate proxies that access Cloudflare as trusted proxies, so that rate limiting, IP blocking/challenge, and geolocation (Cf-IpCountry) act upon the IP downstream rather than the Google proxy itself. These proxies have a reverse DNS like google-proxy-74-125-208-48.google.com and they properly set the X-Forwarded-For header.
This would allow to block a certain class of DDoS attacks that hide behind Google Translate, without blocking legitimate Google Translate traffic.
Cloudflare could automatically do this for google-proxy-*.google.com IPs, and/or allow each user/zone to specify their own list of trusted proxy IPs.