to clarify, there are several email addresses set up on the domain with email routing set to forward to various addresses, mostly in gmail. Some of them are routed to google group addresses ([email protected]).
The google group is set up with no moderation or other filtering rules (it works fine to send emails directly to it and I have used it for forwarding in the past when the domain was hosted in google domains). I can see the bounced emails in the activity logs of the email routing tab in the cloudflare dashboard and for the ones I have managed to retrieve, there DKIM errors. I can forward headers if this would help.