I find the 94% figure believable (for requests, not source IP addresses), Tor is after all the obvious choice for low bandwidth DoS attacks and unwanted scrapin

I find the 94% figure believable (for requests, not source IP addresses), Tor is after all the obvious choice for low bandwidth DoS attacks and unwanted scraping (i.e. a few individuals will generate a large percentage of Tor-routed requests at any time). The real issue with CF for me isn't the hassle with captchas, but the fact that CloudFlare can track users across all its sites, generate profiles and even read unencrypted traffic. It's a privacy hazard by design that makes Tor particularly attractive. But as long as Tor is used only by a small minority, it will be treated this way.