I can't speak for Cloudflare, but crawling speed should be dictated by the site owner via the robots.txt crawl-delay. [1] A site owner could also rate-limit unauthenticated requests by IP via the cloudflare header using a 429 too many requests error page.
[1] - https://en.wikipedia.org/wiki/Robots_exclusion_standard#Craw...