it makes sense to send IPs to Cloudflare to block.
but why use fail2ban ?
all the http connections is from Cloudflare, use fail2ban(or iptables), you can only drop Cloudflare IPs.
since Cloudflare server is in front of lsws, and actual connections are between CF and lsws, I'm not sure how...