Cloudflare by default caches certain file extensions (like css, js, jpg etc). If the response is a 404 or 403 the response will be cached for 3m and 1m respectively, if there is no other cache-control header.
If your 403/404 URLs do not match the standard file extensions, you will need to have a Cache Everything page rule.
This is described in more detail here: https://support.cloudflare.com/hc/en-us/articles/200172516-Understanding-Cloudflare-s-CDN#h_51422705-42d0-450d-8eb1-5321dcadb5bc