It kind of depends on the risk vector one tries to mitigate on how to tackle this:
To mitigate (D)DOS attacks we usually recommend implementing an rate limit at the "edge" (meaning CDN, or Proxy)
In your case you could either use CF's rate limit feature or use fail2ban with nginx coupled.
Reason being you want to offload that traffic before it hits zitadel.