We put this down to people with JavaScript disabled or ad blockers. CF does filter bot traffic but will capture all hits as it’s tracking through network requests. For us it’s around a 35% increase in what GA reports.