As the bad bots tend to change randomly their identifier (outside the list I made before), I enabled captcha for everyone except known bots, that should help with the bots not detected as bots. In the last hour it seems there were lots of issues, I suppose too much traffic, I'll analyze the logs later.
For real humans that captcha should not be an issue, just a checkbox once a day added by Cloudflare.