I did some further testing. Manually accessing the firewall with the hostname works:
curl -k --resolve image.example[.]my:443:123.123.123.123 image.example[.]my
Hostname and DNS in CF are also correct.
But when I access the URL with this hostname via browser and CF, there is also a 521 error