Without a custom domain that you can direct through cloudflare, it’s very difficult to stop bots in my experience.
If you think that is a deliberate attack you could try temporarily dialling your site for a week to make them think they’ve won, then reactivate it. But that’s not guaranteed
Unfortunately, it’s very hard to avoid this problem. We have some measures in place to protect your website against bad bots, but identifying bad bots is difficult and sometimes subjective, and the only perfect solution for stopping bad bots is to just not make your website available on the internet at all.
Your account usage graphs show that you had both high hits usage and high CPU usage, so it’s definitely a traffic issue.
I noticed one thing though: you have a single hosting account with multiple domain names and databases, which probably means you have multiple websites hosted on them. Remember that you can create up to three free hosting accounts, which each come with their own CPU and hits pool.
So if you have two websites on one account right now, you could effectively double your resource quota by moving one of the websites to a different account. With the added benefit that if one website gets attacked and suspended, your other website will keep working.