Related Cloudflare forum thread:
Cloudflare generally requires that the websites behind the CDN whitelist their IP addresses, and use the header Cf-Connecting-IP to get the visitor’s correct IP address.
https://support.cloudflare.com/hc/en-us/sections/200805497-Restoring-Visitor-IPs
I imagine some code work on the Gitlab pages side would be required to fix this rate limiter functionality. The code should first check the connecting IP against a list of Cloudflare IP addresses https://cloudflare.com/ips and only use the Cf-Connecting-IP header when it’s coming from a CF IP.
Note: X-Forwarded-For is also set:
Edit: made a issue on the gitlab-pages repo about the issue with a fix.