The Real Visitor IP setting is now fixed with this (that rolled out yesterday) – so security plugins like Wordfence now work correctly again when using this product from Cloudflare.