There is not-insignificant, if not huge group of site admins that take a "aha! more security therefore better!" approach and will just enable under attack mode (the 5s JS challenge) for everyone all the time.

Some are a bit more savvy and will take a still rather ham-fisted approach of doing so for most countries. That's not uncommon with retailer websites that realistically only serve a single country, and therefore have good enough reason to challenge all others to deter automated traffic from compromised machines outside their market.

I see it ALL of the time. I am not sure if it is due to Safari and ITP blocking whatever protection tracking stuff Cloudflare does, or because my DNS is routed through AWS vs some other provider (as I am on a split tunnel VPN, and need to resolve internal DNS entries).

It's frustrating, especially when I open a couple of tabs on the same site after Googling a particular problem.

It could be the ITP blocking or your DNS setup. If I had to guess it'd be the AWS setup you have as that is not seen as a client IP for a home network.

The interstitial page you're seeing attempts to validate IP location, HTTP headers, and the query string at the very least. So the fact that your requests look like they are coming directly from an AWS IP would, based on my gut feeling having troubleshot tons of these issues at CF, cause this issue.

If you're ever curious you might want to try and hit a site you know serves you these pages regularly without the VPN setup just to isolate the problem.

My traffic hitting Cloudflare does NOT go through an AWS IP. It is still my home IP address.

My DNS request to request the site is through the AWS DNS in my VPC.

When I hit the same sites without VPN, and thus use my local DNS resolver on my network, no issue.

The only thing going over AWS is the DNS resolution.