Cloudflare checking connection despite not subscribed to service

Thanks for the input.

As @aj14 pointed out, the problem is as bright as day, we just selectively overcomplicated the situation.

After realizing is a suspicious domain we did a quick scan on the site and found it was indeed infected by a conditional redirect malware that impersonated Cloudflare. The sites are then redeployed and are now operational again.