Yeah, many DDoS attacks get through cloudflare's lower tier plans, in fact bypassing cloudflare free is considered the bare minimum for a "stresser".