If you do not use mirage or polish, then Cloudflare aren’t touching or optimising your images AFAIK. But yes I tested my site in gtmetrix and it does report compressed files being larger than uncompressed for my CF free plan wordpress blog at https://servermanager.guide/
Check gtmetrix reporting compressed size as if you drill in with + sign to expand the image and inspect content length it reports the smaller size.
i.e. here 3388 bytes is uncompressed and compressed response header’s reported content length matches at 3388 bytes

now to verify use webpagetest.org to test https://www.webpagetest.org/result/191113_PH_232ab4a5522f3a61455ef1154a2319cd/1/details/#waterfall_view_step1
response header content length = 3388 bytes

Check in Opera browser network devtools and same 3.3kb sized image but 3.5kb transferred over network due to headers and cookies attached to the request

gtmetrix is reporting compressed transfer size including cookies + headers it seems ?
I wrote a guide on using webpagetest.org at https://community.centminmod.com/threads/how-to-use-webpagetest-org-for-page-load-speed-testing.13859/ 
edit: double check with h2load HTTP/2 test for my image file to see break down of data transfers
uncompressed h2load request
h2load https://servermanager.guide/wp-content/uploads/2019/07/servermagaer-feature1.png
starting benchmark...
spawning thread #0: 1 total client(s). 1 total requests
TLS Protocol: TLSv1.2
Cipher: ECDHE-ECDSA-AES128-GCM-SHA256
Server Temp Key: ECDH P-256 256 bits
Application protocol: h2
progress: 100% done
finished in 100.83ms, 9.92 req/s, 37.70KB/s
requests: 1 total, 1 started, 1 done, 1 succeeded, 0 failed, 0 errored, 0 timeout
status codes: 1 2xx, 0 3xx, 0 4xx, 0 5xx
traffic: 3.80KB (3893) total, 429B (429) headers (space savings 32.33%), 3.31KB (3388) data
min max mean sd +/- sd
time for request: 51.84ms 51.84ms 51.84ms 0us 100.00%
time for connect: 48.84ms 48.84ms 48.84ms 0us 100.00%
time to 1st byte: 100.64ms 100.64ms 100.64ms 0us 100.00%
req/s : 9.93 9.93 9.93 0.00 100.00%
particular traffic sent
traffic: 3.80KB (3893) total, 429B (429) headers (space savings 32.33%), 3.31KB (3388) data
versus compressed request
h2load -H 'Accept-Encoding:gzip' https://servermanager.guide/wp-content/uploads/2019/07/servermagaer-feature1.png
starting benchmark...
spawning thread #0: 1 total client(s). 1 total requests
TLS Protocol: TLSv1.2
Cipher: ECDHE-ECDSA-AES128-GCM-SHA256
Server Temp Key: ECDH P-256 256 bits
Application protocol: h2
progress: 100% done
finished in 73.00ms, 13.70 req/s, 61.63KB/s
requests: 1 total, 1 started, 1 done, 1 succeeded, 0 failed, 0 errored, 0 timeout
status codes: 1 2xx, 0 3xx, 0 4xx, 0 5xx
traffic: 4.50KB (4607) total, 428B (428) headers (space savings 32.49%), 4.01KB (4103) data
min max mean sd +/- sd
time for request: 41.65ms 41.65ms 41.65ms 0us 100.00%
time for connect: 31.22ms 31.22ms 31.22ms 0us 100.00%
time to 1st byte: 72.81ms 72.81ms 72.81ms 0us 100.00%
req/s : 13.71 13.71 13.71 0.00 100.00%
traffic: 4.50KB (4607) total, 428B (428) headers (space savings 32.49%), 4.01KB (4103) data
does look larger hmm
- uncompressed request = traffic: 3.80KB (3893) total, 429B (429) headers (space savings 32.33%), 3.31KB (3388) data
- compressed request = traffic: 4.50KB (4607) total, 428B (428) headers (space savings 32.49%), 4.01KB (4103) data
@ryan @cloonan curious why data size is larger at 4103 bytes vs 3388 bytes though browser, gtmetrix and webpagetest shouldn’t be doing compressed requests so h2load compressed request wouldn’t happen in real life
so uncompressed h2load request has 429 bytes being headers + 3388 bytes data so in theory compressed headers + cookies + uncompressed 3388 data bytes would equate to gtmetrix and opera browser reported 3.5KB transferred over the network
Note this is same for network transfer size and gtmetrix compressed vs uncompressed for non-cloudflare sites too so it should be just normal network transfer overhead/cookies/headers which gtmetrix is reporting in compressed size numbers ???