And I hate it when people respond like that when I am spending my time in helping them, so that makes it a draw 
.
Yes, and “proxy” means that the request passes through Discourse. The request is not made by the browser to the CDN but by Discourse.
Did you set up the CDN as a full site CDN or as the S3 CDN ? I suspect the latter. And in that case the request is made by Discourse to the CDN, without a referrer. But the CDN can still recognize that it is a legit request because the request is originating from the Discourse IP. Hence my advice to whitelist it.
Edit: you could check by turning off the protection for a short while and looking at the logs in Bunny, and see which IP they’re coming from.