This seems to be an unfortunate trade-off of using Cloudflare. You can't just exclude RSS pages because they are just as vulnerable to attack.
There is no easy solution. Apparently Cloudflare rate limiting can work, but that comes at a cost.
We're poor and this is the poor man's solution.