Sami regular reminder that Cloudflare issues certificates for all the domains given to them, even adding their own CAA records if some got set up. This behaviour can be disabled but is an insane default when not using the MITM as a service already.
https://developers.cloudflare.com/ssl/edge-certificates/caa-records/#caa-records-added-by-cloudflare