If it's TCP HTTPS and making established connections then it is not spoofed. Spoofed TCP connections will be SYN packets but a TCP handshake and TLS handshake

If it's TCP HTTPS and making established connections then it is not spoofed. Spoofed TCP connections will be SYN packets but a TCP handshake and TLS handshake will not complete. More likely someone abusing a proxy capability of Cloudflare which is why reporting it to them along with logs is very important. They process massive amounts of traffic so logs with accurate timestamps NTP correctly running on the web server are important to find the needle in the haystack.