In some cases you may be presented with a Shield challenge where you may otherwise expected it to be. Shield challenge can stem from all Shield features:
WAF: Custom WAF rules can add a Challenge to matched request patterns.
DDoS Mitigation: With increasing levels of security, a Challenge may be presented to users to validate the access of the site.
Rate Limiting: Rate Limiting rules may introduce a Challenge page if selected, once a user has triggered the rate-limit condition.
Bot Detection: Bot Detection may Challenge if selected if there is suspected bot actions.
Access List: Predefined Access Lists can be defined to present the challenge window, as well custom created ones.
In reality, you should not be invalidly triggered a Challenge, if any of these settings fit inside the scope of your Shield configuration. The challenge is designed to be resilient to bad actors and pass through legitimate users.
If you have any questions on Shield challenge or triggers, please reach our to the Super Bunnies (support@bunny.net) who will be able to aid you more on the subject.