Perhaps those aren’t Cloudflare PoPs, they’re attacker MitM/honeypots.