There had been a RewriteRule on the hosting server, which I thought might be creating some kind of odd loop. But the behaviour is the same with that rule removed from my .htaccess file.
That’s an infinite loop because you’re rewriting * to be large, then hitting the rules again, which again catches “large” because of the wildcard. And so, and so on.
Just the one symlink on the server if everything really is in /images/large
But if you’re able to get it to work without Cloudflare by using mod_rewrite, that shouldn’t change if you enable Cloudflare. It sounds like there’s something else going on.