I’ve checked the activity logs under my other website which is not affected. From the logs it seems like Cloudflare did some interesting automations, deleting and creating DNS is only one of them.
Apparently there’s user API Tokens vs Account API Tokens! I found the culprit and deleted them. Will monitor this for tomorrow. Thanks so much for the hint!