Discourse overloaded real traffic or DDOS? 100% CPU usage despite of decent traffic and high specs server

Even if Cloudflare is set up correctly, you will still see CF IP addresses in netstat, so this is not necessarily a sign of the cloudflare.template.yml not being set up correctly.