CF uses different methods and is more/less aggressive depending on which website it is.
- Patch the fingerprint (works alright with TLS 1.2 in OB2)
- Rotating proxies + spoofing (HTTP2)
- Write some endpoint to programmatically solve the JS challenge.
Don't expect it to be easy at all unless you are lucky finding some misconfigured server