The incoming ip is the ip of Cloudflare and not the abuser IP.
How ever hestiacp rewrite the ip for logging.
Source: Firewall IPSet Test. Is not working properly? - #4 by eris
In short, if you proxy through CF (orange cloud), HestiaCP cannot block that IP address. You’ve effectively handed security over to CF. For some reason, CF still forwards IPs with an abuse score of 100 to our servers. If you want to block the IP address on the HestiaCP side, you need to switch it to the gray cloud. So you need to decide which side will handle security.