It probably just uses the Referer header to determine where the click came from right? I'm sure there are privacy browsers / extensions that strip that header out of requests.
cloudflare also cuts off people's service if they are subject to frequent DDoS attempts. they're a notoriously shady company and it's why many organisations go for other anti-DDoS services.
502 is bad gateway, 500 is internal server error.