There's a pretty good write up on how it works here: https://blog.cloudflare.com/cloudflare-supports-privacy-pass...