You can either spend $5 per month for VPS for a webserver for your static blog which you now have to secure properly, or you can just stick it on Cloudflare Pages for free
Cloudflare bot protection adds a slight delay (as in seconds) at best, and completely blocks users like the parent comment at worst. It costs no money, but isn't free either.
We are talking about different products though, I believe you can have your webpage hosted on Cloudflare Pages or behind Cloudflare CDN without enabling invasive "bot" detection.
You don't need to host in on cloudflare, just use github pages - it's cdn is plenty fast.