Currently, the record is not proxied, but the Cloudflare origin certificate is only valid for proxied records. On the other hand port 15001 is not a Cloudflare supported port.
So you either have to set it to a Cloudflare supporter port, and then you’ll be able to proxy the NAS, or you have to leave it as DNS only request a certificate from a valid CA.
Related
My advice is that you have your router forwarding one of Cloudflare supported ports (for instance 8443), internally to the Synology IP on 15001.
This way
1 - you’d be able to access it externally in yourdomain.com:8443
2 - you’d be able to set the DNS record as proxied.
3 - and the origin certificate would be valid.
4 - as a bonus you’d be able to use all Cloudflare features in your account like waf rules.
Edit.
As an end note, if your Synology supports it, consider using a cloudflared tunnel instead as it would not require your current DDNS, it would not require a certificate at the origin, and you’d still have external access, with the added bonus that you could integrate it with Cloudflare login, or SSO.