From my experience with Cloudflare, hard blocks are either caused by something that is similar to known exploits or by the site operator blocking countries/ip r

From my experience with Cloudflare, hard blocks are either caused by something that is similar to known exploits or by the site operator blocking countries/ip ranges. Everything else it's the annoying captcha or the less annoying "managed challenge" (usually a quick check before loading the page or a request to manually click a box).