I worked with Alexey on this project. It’s pretty straightforward to filter out bots (either before send, or in analysis later). For our traffic, it was mostly commonly known bot user-agents.
I’m also pretty sure malicious bots get blocked by Cloudflare before hitting the Cloudflare workers.
When dealing with ads, most "bots" are actually clicks coming from click farms, which are from real devices. I'm not sure what's the best way to filter those though.
