recently trying to ban ip blocks from some bad actors, found I can't get their actual ip in my raw access logs. The really bad people just show up as cloudflare ips in the logs.

So I find a cpanel plugin that is to help, but it was once promoted by cloudflare and no longer supported. There is now some command line thing that needs install and some nano/vim to add cloudlfare things into it.. after a few rounds of trying to piece this together I found it much faster/simpler to disable cloudflare.