WAF rules and Telegram / X / Facebook

We're on a free Cloudflare plan and we have a domain that is often in ddos.
It seems like Telegram gets a js challenge even if we explicitly filtered TelegramBot to be good.

Is there any specific ruleset to work with crawling/indexing/link preview bot?