[tux3]

I assumed OP wants to know the identity of the Cloudflare users scanning their SSH ports.

I think OP guessed it was probably not Cloudflare themselves scanning their ports, so I think that's what they meant by "hear who and why".

Maybe dox is too strong a word. My point is, from what I've heard, the general sentiment is that you're unlikely to get any information about customers just by sending abuse reports to Cloudflare.

[chmike]

OP obviously simply expected at least an explanation on the cause of these ssh connection probes. He got the explanation here (VPN).