There are some attacks that will slip through cloudflare unfortunately. There is definitely more to do, but it gets progressively more expensive.
You could take a look at Sucuri, or StackPath. If that doesn't work, there are other vendors, albeit (very) expensive.