Yes, I should have been a lot clearer before throwing out an accusation like that. What I meant to say is that to the best of my knowledge I'm not using any of their services directly. The first thing I suspected was that Porkbun, my registrar and NS provider, requested them on my behalf for some service they offer. This would still be odd, as I do not recall ever using any of their services that would require this either, and their support stated that they don't recognize the certs.

My main gripe with Cloudflare is not that they issued these certificates. It's the fact that they are valid for one(1) year and I don't have an easy, preferably automated way to have them revoked.