Posting this on a burner account for obvious reasons but I was able to bypass Cloudflare’s IP based restrictions using Apple’s iCloud relay when my connection was being relayed through one of their POPs. As far as I can tell the issue is fixed now but I’m unsure if they ever notified customers.

The product seems to be fraught with security issues for Apple customers and others.

Private relay seems to be fraught with privacy and security issues. I was able to use private relay to bypass IP based restrictions to all sites using one of the CDNs that private relay uses.