Cloudflare’s normal CDN Product will only proxy HTTP Traffic. That is to say, any traffic sent to yourwebsite.example:3306 wouldn’t reach your origin, as Cloudflare does not proxy SQL Traffic or even have that port open.
It sounds like attackers may have discovered the actual IP of your Origin Web Server (the web server you have behind Cloudflare), and attacked that directly. I would double-check your origin’s security: https://developers.cloudflare.com/fundamentals/get-started/task-guides/origin-health/
At the very least, ensure you are only allowing Cloudflare IPs, and after you do that, you may want to rotate/change your origin’s IPs if you can.