This seems to be CloudFlare doing terrible things – for no reason whatsoever with it’s “protection and caching layer”.
I’ve switched it off for now, and in ~4 hours or so, all requests should be direct again.
I’ll keep tabs on this thread to hear back if things are fixed.
Sorry about this whole mess.