I assumed OP wants to know the identity of the Cloudflare users scanning their SSH ports. I think OP guessed it was probably not Cloudflare themselves scanning

I assumed OP wants to know the identity of the Cloudflare users scanning their SSH ports. I think OP guessed it was probably not Cloudflare themselves scanning their ports, so I think that's what they meant by "hear who and why". Maybe dox is too strong a word. My point is, from what I've heard, the general sentiment is that you're unlikely to get any information about customers just by sending abuse reports to Cloudflare.