One just-as-easy way to reduce spam is to use google captcha only on actual spam entry points, meaning when an user wants to post a comment and such, but Cloudfare just covers absolutely all requests and doesn't care you just wanted to access an static version of the URL.