cache-control: max-age=31536000
cf-cache-status: HIT
When you enable the Development Mode, what HTTP caching headers you get?
If you switch for the URI with the URI path and change starts with to containsmedia-dash (no need for start slash /), Purge Everything, and check again, does anything change?
Furthermore, since the sub-domain is media.domain.tld, so the Cache rule applies exactly for the hostname, if you switch starts with for the Hostname with the equals, Purge Everything, and check again, does anything change?
Nevertheless, regarding Cache, under the Caching → Configuration, what you’ve got set for Browser Cache TTL? Is it set to “Respect Origin Headers” or?
Were the images cached since before, therefrom the HTTP caching headers are cached and you might have to Purge Everything to flush this?
Any other Cache Rule or it’s this the only one and first from above on the list?