Turns out the requests came from Tor which Cloudflare apparently recognises as a country, so just needed to WAF them out.