Since this seems like this is a pretty active site, how is the GA pagespeed tab showing that things are doing since the switch?
As for as the threats blocked, they just blacklist ip addresses, they are not usually actual threats. Think about when you run a virus scan and it says it protected you from 125 threats and then you just see that it is talking about tracking cookies. Most of the threats are known TOR exit nodes. Which some people use them for things like that, but others use them because they can access content that is blocked in their country.
As far as the file requests, it does help shed file load, which is good. But that is what a CDN would do as well. Both of them do not cache page requests either, so they do not change the actual processing and page loading time of the site. They just change the asset loading time.