Visitors are rate-limited per IP address. Behind a CDN or proxy, every visitor can appear to come from the same address. Add the site_mascot_client_ip filter and return the visitor’s real IP:
add_filter( 'site_mascot_client_ip', function ( $ip ) {
return $_SERVER['HTTP_CF_CONNECTING_IP'] ?? $ip;
} );Use the header your CDN documents, and only when you trust that header is set by the CDN.