Welcome to the Cloudflare Community. If you subscribe to a plan that includes support tickets, you can find how to create them along with response expectations on this page. Depending on your subscription, response time may take five days. Posting in the Community will often provide faster results.
What user or API credentials does your audit log indicate was used to make the changes? Whoever you have shared those credentials with is going to be the source of the unwanted changes.
Do you use Ezoic? Once you integrate with Ezoic, all of your DNS changes need to occur in their platform as they automatically update your Cloudflare records to match theirs.