These match the peaks in the charts I see in the Cloudflare dashboards.
It seems that there is a peak of visits of these bots every few hours (even if they are there permanently), but I don't know if Cloudflare can see these are a real attack (maybe it will just see that as a peak of visitors), we'll see. In the worse case, I can enable something to force visitors to pass a captcha.
I'll enable the filtering later today.