When using your domain with a Cloudflare Partner (such as WPEngine in this case), you do not have control over the rules on your zone. The redirects will have to be created in WPEngine.
Wow, I was not aware of that. It’s not really communicated in the interface either.
Tested now, and found a menu in WPengine called “Web rules” that almost matched the settings in Cloudflare. I can do blocking on geolocation there, not redirect, but that will do for now.
Thanks for the hint! I might test to see if pointing Cloudflare to the “legacy network” in stead of the “advanced network” IP addresses on WPengine will enable the rules to work from Cloudflare.