TOR doesn't really play the part in this you might think, it might be best to use when you're browsing and paying for DDoS services but its not a role in a DDoS. Using a surface web botnet built for DDoSing targets would be much more effective then using TOR somehow since its relatively lower bandwidth compared to surface web connections.

Voat is still using cloudflare, even if our bits aren't being checked.

And whose posting activity did they want to deanonymize? We have no way of knowing because PuttItOut fudged all the post timestamps around this time to prevent people going back and checking.