Honestly, those stats at cloudflare are misleading. You're not saving as much bandwidth as they claim you are. Also, they're uptime has been just horrible, or to be more specific, their performance. They're uptime is reasonable, but their servers are constantly under ddos attacks and are just too slow at times. I had better results just installing varnish, does pretty much the same thing.

You'll find that mod i posted WILL save you tons of bandwidth as all the users can testify to :)

Consider litespeed. Its a paid solution but its much faster than apache and lets you use all apache software like directadmin / cpanel like before. It has a cache system comparable to Varnish. Im moving to it when my new cloud hardware comes in. Nginx is is more difficult to maintain.

Another thing to consider is Bad behavior, which will reject user agents from bad bots. I had very good results with that. It also bans bots by user agent, but also anything thats on the long blacklist.

I dont think that 1 new server will be enough for you. Especially not on apache.

Adding a script to block bots will increase the server load, the issue here is not with bandwidth, but with the server load. The op doesn't have server access I don't think. One way to decrease the server load in vb is to reschedule cron jobs around your peak hour(s).

I'm not sure what can be done on a VPS but look into mod_evasive for Apache2 and fail2ban.

mod_evasive will throw a 403 error page if someone is banging at the server. With a custom rule, fail2ban can then detect if the 403 page has been sent x times and ban the IP from the server for x amount time via iptables.

Used together you would be surprised how many "bad bots" get killed from banging away at a server.

Did u try to CDN for images , css, js files ?

try cdn
whats your control panel ?