Why do you have a cloudfare tunnel to home servers if the only thing that can access it is your VPN that originates from your home address? I may be misunderstanding you.

I am assuming that threshold would be logged in the postfix logs?

Excellent write up! I've saving this one for sure. How did you go about investigating this and troubleshooting? That deserves a write up by itself!

What do you use for l7 firewalls?