I mean, it very easily could be. A service like WARP, they can decrypt the traffic, if you allow them to (it is off by default). The warp client will add the certificate to the trust-store, and the traffic will get decrypted on Cloudflare’s end.

For my kid, I kept deep-inspection off. If he figures out how to get past DNS and SNI inspections, he deserves to see a boob or two.