Update:
That one post that wasn't federating on Mastodon appeared when I turned off bot security, so good call!
I turned off Cloudflare's Hotlink Protection and the federated images appeared on Pixelfed, but only up to 52 weeks ago (a year exactly). More recent posts do not appear, why would that be?
Unless there's a workaround, I guess this all means I need to decide what's more important to me, security or smooth federation.