It’s not really an ‘issue’ per-se - Cloudflare performs on-the-fly decompression of content if the client (you) doesn’t support gzip, this saves on bandwidth to origin as gzip is always used even if the client is served it plain.
This scenario is really only an issue with curl or other handmade requests - browsers would always indicate they support gzip with the accept-encoding header.
IIRC Cloudflare transparently decompresses responses that have a Content-Encoding header if the client does not indicate support in the Accept-Encoding request header. If you want Cloudflare to return the GZIP-compressed file to all clients, you will have to remove the Content-Encoding header from the origin response.
You can also try making the origin send a no-transform directive in its Cache-Control header for those tar.gz files (Not the others that you want to be transparently compressed for browsers). This should stop Cloudflare from modifying them with transparent compression or decompression.
After some internal discussion I updated our origin server to stop returning Content-Encoding for .gz files, and that seems to have resolved the issue. Thanks very much to everyone for your quick and helpful responses!