Check your own access logs to see if your origin server is giving the 403. Anything Cloudflare fully blocks shows up in firewall rules.
Also make sure you’re restoring visitor IPs in case it’s being rate limited or your origin software has issues with the Cloudflare reverse proxy.
https://support.cloudflare.com/hc/en-us/sections/200805497-Restoring-Visitor-IPs