It actually does not come from Cloudflare. It is being served by your origin on port 80 which is used by unencrypted HTTP. When you use the insecure Flexible setting in Cloudflare, your HTTPS connection to Cloudflare is then sent unencrypted to the HTTP port on your server, which you can see is serving different content than the HTTPS port.