Unfortunately, Cloudflare (and other DDoS prevention services) work on a reputational basis: if they see a lot of bad traffic coming from a specific IP or IP range, that IP has to complete a range of security checks before loading a site that has its DDoS protection turned on. A lot of spam and DDoS bots use VPN services, so unless your VPN provider is vigorous about removing them, you probably keep getting issued IP addresses that are flagged as abusive because the person who had it before you was doing abusive things with it. You may want to contact your VPN provider and let them know it's happening, because it usually means they're not being proactive enough about abuse on their network. Or it could be the browser settings problem shadowspar mentioned! But if it happens in multiple browsers, it's probably the IP reputation.

It's the same reason a lot of Tor exit nodes get blocked everywhere: the people who are using the services for legitimate privacy/security purposes often get drowned out by the people who are using the services for abusive purposes, and once the percentage of people using a service for abusive purposes gets high enough, sites have to block the entire service even though it collaterally blocks people using the service for privacy/security purposes. We try to keep our protection settings turned down as far as possible to avoid catching as much legitimate use as possible, but we get a lot of abusive traffic, so sometimes we need to be indiscriminate.