I looked up hostnames in in question using https://radar.cloudflare.com/categorization-feedback and all the hostnames in the CNAME chain have a valid categorization. However 1.1.1.1 is still blocking the requests with following reasons:
("…failed to verify [redacted_hostname] CNAME")
("…[redacted_IPv6]:53 rcode=REFUSED for [redacted_hostname] NS")