A small, single EU country focused non-static e-commerce, with proper robots.txt instructions that worked perfectly well in the search & co bots -only "era" with rate limiting for nginx/php-fpm setup - is kinda struggling without CF to handle 15000 requests per 15 minutes, coming from Chrome "users" from IPv6. Best so far was an avg. server load in htop = 40 on an 8-core server x_x
Block out IPv6 and see if that helps.
> handle 15000 requests per 15 minutes,
that's just ~17 req/sec
That's "cheap VPS running wordpress" level of traffic