I'm sure you've heard this before but Cloudflare isn't really a CDN. CDNs don't have to intercept requests to be useful.

I think what you describe is closer to "TLS terminating reverse proxy", which does need to intercept every request.