From New DNS changes detected without prompt - #2 by matteo it suggests Cloudflare sometimes rotates the IPs assigned to CF sites which are behind the proxy orange cloud 
and that this sometimes triggers domain monitoring service alerts with 3rd parties.
My suggestion is to add a feature for CF users to have a historic log time stamped for such changes and maybe an alert of some kind notifying for such rotation. This would help inform CF users so they don’t panic and wonder if their domain/domain registrar was hacked/compromised.