"ok we got so many requests from this IP, lets ban it"
Yes, you are right. More than the ip addresses, Cloudflare scan to see what resource they are requesting, what payload they are posting, how frequently they're making requests, etc.
So, to answer your question Cloudflare doesn't just blacklist an ip address of possible DOS, instead they apply a complex algorithm to determine if the sourcing address is a bot or legitimate user. But it is safe to agree that even thousands of requests from multiple internal systems to a (cloudflare) protected web application is easily handled without bottleneck due to their caching policy, updates the cache for your web app every hour.
Also understand that after implementing cloudflare or similar services to your Web-Application, the request for resources reaches your Web-Application only if the Cloudflare doesn't have it cached. By the time the 10th request is made , It is already cached in their data centers around the world and the next subsequent requests are distributed to close hop Cloudflare data centers from there onwards.
I urge you to read through this post in Cloudflare ( click HERE ) to understand the technical details.
I hope this gives u a gist of Cloudflare like service implementation. And these days a few hundred-thousand requests from a single ip-address is not treated as a threat but are only analyzed more for possibilities (as they are aware that it might be an intranet of systems requesting services from the same Web Application)