2,230,909 Page views 2,094,927 regular traffic 126,337 crawlers/bots 9,645 threats
While there certainly are a lot of automated visits, they are still a fraction of what appears to be legitimate traffic. Furthermore, I'm pretty sure that CloudFlare blocks or challenges (edit: malicious) bot traffic, so I doubt that is the spoon that is stirring the pot.
I am not alone in reporting this: https://www.seroundtable.com/https-google-adsense-19035.html
It is a serious issue, one which I'm sure is hindering https adoption around the web.
I'm proud to contribute to a saner Internet and it does matter even for small blogs because I noticed networks that inject content in websites - I don't know how this practice evolved in the US, but a couple of years ago while traveling there the Wifi networks in the 2 motels I stayed at were injecting ads in the websites I was visiting. I found that to be extremely distasteful.
For me HTTPS is a way of signing my content. Shameless plug - https://www.bionicspirit.com/ :-)
Considering that at least part of the ad clicks comes from robots (there was a recent post about that on HN), it might be that some of your lost revenue was due to that effect.