How to understand if Chinese traffic legit?

Check the referrals. Usually, cPanel comes with Awstats, there you can see exactly were the traffic is coming from, and also check the keywords.

Use Google Analytics to analyze all incoming traffic to your site.

Should I challenge them via cloudflare? Because we get no profit from china traffic.

Yes you should