Thanks for the reply.
I have since discovered that I was wrong about this. I believed that since I could not see any 403 responses in my origin site web logs that they must be coming from Cloudflare. However, eventually one of my German customers emailed me a screenshot of the 403 response page, and it was clear that it did not carry any Cloudflare branding. Sure enough the origin server had a firewall rule that was blocking traffic from Germany, and also this meant the traffic never hit my domain name on the server so there was nothing in my origin site web logs. I resolved the issue by getting my ISP to remove the firewall rule.