The stat script uses the ip-addresses for the identification of different visitors.
If your visitors are entering the site only via 1 or 2 different ip addresses of Cloudflare, the stat can only identify 1 or 2 visitors.
We implemented a feature called "recount time" (default 1440) as the number of minutes after a visitor should be tracked as a new one (by having the same ip address). So you could set this setting to 1, meaning after 1 minute a already known ip address is counted/tracked as a new visitor.
Unfortunately there is no other way to differentiate between visitors. In your case, the user agent string should also be part of the identification process to be sure tracking all visitors.
In your case, with the desired setting above (1), all hits of 1 ip address will occure as a different visitor. This leads to "hits = visits", it's not perfect, but better than now.
Any comments or suggestions ?