You are referring to Flywheel | Cloudflare on Flywheel, right?
Apart from that inappropriate Flexible suggestion the walkthough looks pretty reasonable. Based on that I’d also assume Cloudflare’s addresses should not be blocked, yet thats exactly what appears to be the case, otherwise you shouldnt get a 521.
You currently have “Full strict” on and your DNS records are exactly what you showed in the screenshot, right?
Can you post a full page screenshot of your SSL/TLS screen on Cloudflare?