Although it is possible to utilize SPCAF in gulp without a valid license, you will find that you will get more errors, compared to running SPCAF with a license.
The reason for this is when SPCAF is used without a valid license it uses a default ruleset, which does not have the configuration of the SPFx ruleset, which is used with a licensed copy of SPCAF. The increased number of warnings/errors (including auto-generated ones) could make it harder to correctly identify a true issue. So although the processes are being used the results will differ greatly.
Another benefit from running a licensed copy of SPCAF in gulp is that it will identify what the errors are.
For example, below is a sample of code being run without a valid SPCAF license, as you can see there is 19 notification including 1 critical warning and 1 critical error. Unlicensed SPCAF results in gulp
You can purchase a License for SPCAF by going to https://www.spcaf.com/pricing/.