Yes. It’s a proxy. Traffic between Cloudflare and you is encrytped with a certificate issued by Cloudflare. The connection between Cloudflare and your server uses your certificate. Therefore they need to decrypt and immediately encrypt the traffic again. It’s the same behavior as a local web proxy you’d use on (company) LANs.
When the SSL setting is set to “Full”, the origin server also needs to be set up with its own HTTPS certificate and be able to respond on port 443 itself.