It should return 429 so Google can reduce the requests.
I'm not even sure why you would rate limit in the first place? IPS are not unique. One company gateway or university for example has plenty of users.
Rate limit requests from users you know and make sure every public API is properly cached.
And yes, it's returning 429 ...
Caching is completely useless as a replacement for rate limiting. Simply add a bunch of nonsense to the url, or change query parameters, and you will bypass the cache.
On the free plan it is perhaps a bit limited in the rules you can create (match based on bot or URL regex, limit by # requests per IP per 10 seconds). But still pretty useful for slowing stupid requests.
https://developers.cloudflare.com/waf/rate-limiting-rules/cr...
And / or you can use Transform Rules to better normalize the Origin URLs so that the query string or other path info doesn't create new origin requests. Or more simply, enable Ignore Query String in the Cache Settings.