I am afraid it’s Cloudflare’s new implemented header by default and cannot be removed via Transform Rules → Response Header, despite the RUM feature is disabled (which seems to add a few more headers related to), as follows in the blogpost below:
Removing it is because I do periodic measurements on the site for performance analysis and could save bandwidth costs where I remove unnecessary headers that aren’t needed during analysis.
When one tries to modify or remove restricted headers like Server or cf-*, an error is mostly raised, but for Server-Timing header, no error is raised. So maybe I thought it was an error on part of their implementation because they haven’t mentioned it anywhere on their docs.
Also, headers like alt-svc are ignored from removing but they don’t mention it anywhere on the docs.