The CSF firewall is reporting the correct remote IP to the script and then that curl command is adding that IP to CloudFlare which then proceeds to block future requests from it.
The script worked for me for a few years (I've since stopped using CloudFlare for other reasons) and another server owner I have dealings with. It definitely used to work - unsure why it might not now given you've said the CURL call to the API is still valid.