Custom conversions are where bots hurt us most. Our outbound apply clicks were inflated by traffic from cloud providers running ordinary desktop Chrome, and nothing in the user agent gave them away. Only checking the IP against data-center ranges cleaned the numbers up. Since you run on Cloudflare Workers you already see the ASN on every request: do you drop or flag data-center hits before they count as a conversion?