It might also be the case that all the bad bots are "doing a Yahoo" and caching the old DNS for much longer than the TTL and therefore still hitting the origin servers directly. Might be worth asking Pair to restrict access to those (at the firewall level) only from Fastly sources.