My bot is whitelisted as well, but when CloudFlare goes to its highest security level, the whitelist doesn't matter, as it will always show a Javascript challenge.

I was afraid of that:
In this case it may not have mattered. Cloudflare was having a real bad morning today. Got the calls from a few clients that they could not get to their own sites from the own offices that are in the IP whitelist.
I'm just flabbergasted that Cloudflare doesn't allow a real whitelist. Makes you wonder: are they trying to force Tor users to use a less secure connection?
What could they possibly gain from that? Wait, never mind:
Cloudflare is very probably an NSA honeypot