My insight is that commercial VPNs have many and varied uses by their customers, some users use them for nefarious uses. So commercial VPN IP addresses typically have a poor reputation, one because they are labelled as "anonymous IPs", and secondly because some users are generating malicious or abusive traffic from them.

I have used the analogy before, but using a commercial VPN in terms of your perceived source IP reputation is typically similar going into some seedy downtrodden bar in the dodgy part of town and rubbing shoulders the local lowlife and crims. You're not a lowlife, but you're sharing a IP with others who are and might typically not wish to be associated with.

Whilst I don't have access to a Cloudflare account with this specific control on it, having spoken to someone who does, there's a dial you can twiddle from laissez-faire to suspicious to paranoid about the reputation of source IPs, and my guess is that IB as a customer of cloudflare that is using their service to defend their services from recurring DDOS attacks have got that source IP reputation dial turned to the max.