Everyone's sharing the hundred

The mistake

The rate limit was originally applied per client IP, so each caller got its own hundred-requests-per-minute bucket. Moving the same per-IP rule to the load balancer breaks this, because every request arriving there already shares one upstream source IP (the balancer sees only the previous hop, not the original client). The "per IP" limit collapses into a single global bucket, so once the scraper's traffic fills it, every legitimate customer is throttled too.