@paulcox Have you considered trying a honeypot field (an invisible form field which, if it gets filled in, you know it’s a bot).
I’d avoid Cloudflare if possible. Too much is centralised there already. It’s a huge privacy concern and single point of failure.)