PCI is always done on scope. What part of system the PANs are touching. So your CDN is just one part of where PANs can pass through and next is the system tha

PCI is always done on scope. What part of system the PANs are touching. So your CDN is just one part of where PANs can pass through and next is the system that sends it out to the network. And if you store the PAN, then the DB. Also is not voluntary, your merchant account will enforce it. PCI is all self assessment till you hit level 1, then you have to bring an auditor in and they'll go over all your systems that handle the PANs and ensure they are PCI compliant. Its not an easy task. PCI 3.0 is coming out with helps deal with target like breaches which ensures compliance continuity, so its no longer a point of time like the past.