[ancarda]

Perhaps it's for https://radar.cloudflare.com/ or maybe a new service where they'll warn you if services like SSH are configured badly or not firewall'd off?

Also, is it possible this traffic is actually coming from a worker, i.e. https://workers.cloudflare.com/ rather than Cloudflare themselves?