URL rewritting?

I’m fairly new to CloudFlare we have been using it for a little over a month so I’m sure I just overlooked something. When we send out emails say from our accounting system they can go to the link in the email to view their account such as invoice.example.com/(information generated by accounting system here). But when the user clicks on the link they are sent to url5115.example.com/click?upn=(some token information). At first, I thought this was a problem with our accounting system but after looking more into it. It’s affecting all of our internal notification systems. When staff clicks on ticket links they are routered to the same problem. If you just copy-paste the link you click on into the browser it works. It’s not just one email client both GSuite and O356 have the same issue.

I figured it out. Apparently out email provider started rewriting links so we can track user behavior. The subdomain they used wasn’t even registered to us.