Bots are unfortunately using all sorts of Cf-Worker headers. This looks like a majour global attack at this point and even my fireweall is struggling to keep up. And I'm surprised that Cloudflare hasn't mitigated it yet. Once things calm down a bit I'll whitelist your stuff for sure (and if anyone else on Nostr is using Cloudflare workers for legitimate purposes please ping me your Cf-Worker header and I'll whitelist it as well).