[quags]

2-3 years ago in a support role I would get requests about domains masked cloudflare pointing to someone’s site. So the other domain would show the content of the other site and be masked by cloudflare. Dumping all the $server variables would pinpoint better where it was coming from and it could be blocked.

[cpncrunch]

I think it's unlikely to be this because it's logging the 301 redirect (which redirects a different page of our site), but nothing after that.

Not really possible to get any more info after the fact.