The issue I had was, I have set inbound and outbound bandwidth limit in OLS webadmin but I still can download files way higher than the limits when I tested. Hence it is possibly acting through trusted ip. I'm using cloudflare as well. But I'm not using show real ip of visitors unlike the OP.