Hi there,
Cloudflare manages CAA records on your behalf for the issuing of universal certificates, unless you add them yourself.
This means, that if you have no CAA records in your dashboard, if Universal SSL is enabled, or SXG, or AMP, Cloudflare might create them (but they won’t show in your DNS tab), disable all those features and Cloudflare generated CAAs will be deleted.
Edit: corrected and added some relevant information
Take care.