Up to a certain volume they serve a page that runs some JavaScript heuristics to figure out if the client making the request is legit or not.
Past a certain volume your service is cut off completely.
The cutoff point depends on the load on their free tier network, which is shared by all freeloaders. Could be someone else under attack and you'd still get cut off.
CloudFlare is a CDN first of all, and it makes its money from paying customers. The free tier and the registrar and the DNS and the reverse proxy and basic DoS heuristics etc. are just there to generate word of mouth and free advertising. Nobody was talking about CF a few years ago when they didn't offer these free services, now every selfhoster and their dog will recommend them.