I went into a rabbit hole into how to detect paying Cloudflare customers (for a technographic product I am building in Bloomberry) and wrote up some techniques here.

Response header analysis were a waste of time (Cloudflare returns the same ones no matter what type of customer they are) so I had to resort to analyzing custom error pages, IP ranges, SSL certificates and more