It might be possible to narrow it down (though, support should be your point of contact in this case) but you will also run the risk of having to “constantly” update the list when addresses change and I guess they can change at any time within the mentioned ranges.
I believe that Cloudflare owns those blocks. So if you whitelist those, only Cloudflare will get in. Any more restrictive and you risk visitors not being able to reach your sites.
As @sandro said, Support can probably give you a better answer, but I doubt they’ll recommend anything more restrictive than what’s listed.
This method is based on verification of the TLS Client Certificate CF presents when making a HTTPS connection with your site, your web server can be set up to deny all requests that don’t present this specific certificate.