Oh, I never expected Cloudflare to handle the problem for free. I would happily have at least a pro level account with them if they treated ipv4 traffic properly. But they don't expose a request's actual v4 address to the backend. The WAF works amazingly well, but it otherwise breaks a critical part of the service.
Don't get me wrong, you're doing the world a service with your service, but why should cloudflare have to handle your problem for free? If you want to resolve your problem, it sounds like it's in your hands - block traffic, or us something like cloudflare/waf. It's not fair that you have to eat the cost, but it's not fair that someone else does either.