You would have to sort it out from you access.log files -- good luck there.
But what IP? They may be using any IP.
You could deny access to the cloudflare ips if you do not need to use them or connect with them somehow.
Read this thread:
https://gfy.com/fucking-around-and-pr...via-proxy.html