They can't, but does it matter? They can connect the domain name to your server (through the tunnel).

> or infer what services I run

Why not? The port is open on Cloudflare's side, it's exactly the same.

The one thing you get from Cloudflare is that probably Cloudflare has a list of blocked IPs and they will prevent them from reaching your server. Though I'm sure there are public lists of "bad IPs" and it shouldn't be too hard to have a firewall that uses them. And anyway in your case you have a list of allowed IPs, so it's not a concern at all.