Cloudflare's bot detection is cool. Some notes:
1. Using HTTP/2 can increase your "score" by ~20.
2. "Anomalies" like lowercase headers are punished.
3. Your client "JA3" fingerprint can lead to penalties (Python SSL socket == bot).
4. JA3 is also compared against your UA.