I haven't done anything, but I suspect that either Leo or Olaf hit a config that priorizes logged-in users over anonymous connections.

Personally, I'm still reading up on Varnish Configuration Language, but I have a good draft of what I want to use to block more bots at the edge.

At least the part that I hoped that Fastly would fix seems to work. We don't exhaust TCP connections on the Pair machine anymore, and Fastly handles all of that.