If the CDN is implementing the explicitly-configured preferences of the specific site, what difference does it make if the blocking happens at the CDN vs. the site's origin server?