Only visitors accessing a combination of a waiting room enabled host and path in a zone are tracked by the __cfwaitingroom cookie. The __cf_bm cookie is placed on devices of End Users by Cloudflare when they access Customer sites protected by Bot Management or Bot Fight Mode.