Seems zoomeye (.org) is a hosted service similar to shodan. I don’t think cloudflare is leaking your ip but rather your server is. Assuming they just crawl ips and make educated guesses, I’d say deny all traffic that doesn’t come from cloudflare for starters. Does your http server being accessed by its ip show anything about your domain?