There is no way you can bypass the CloudFlare protection using User-Agent or the like, because, if it was possible, then CloudFlare's wouldn't be any security at all.
What is probably happening is that either the backend has failed, but CloudFlare can allow the browser to use a cached response, or that the failing is intermittent and the browser still works because it's the next call. It might well happen that your CSV-scraper succeeds and the browser fails, and you do not know because when the scraper succeeds... you don't check with the browser at all, as you've no reason to.
As for what can you do, yes, you can emulate a human being with a browser. You do this by caching any successful responses together with a timestamp, and by retrying after a short pause when you get an error.
function scrapeCSV($retries = 3) {
if (0 === $retries) {
// return an invalid response to signify an error
return null;
}
$fp = @fopen(...);
if (!$fp) {
// failed.
sleep(1);
return scrapeCSV($retries - 1);
}
...
return $csv;
}
UPDATE
To access the second-level cache "as a browser would do" you probably need to cross-breed two different solutions: how to "fake" a browser connection and how to read from curl as if it was a stream (i.e. fopen).
If you're cool with recovering the whole CSV in one fell swoop, and parse it later once you've got it as a local file, then you only need the first answer (there's a more upvoted, more detailed and procedural answer below the one I linked - the one I linked is mine ;-) ).