I think this is a case of the ACME DNS record conflicting with Cloudflare’s Universal SSL. Since these records can conflict, our backend might get the expected value, while Let’s Encrypt does not. This is a common pain point, and in fact is one reason why we just released new certificate workflows to help improve this in Easier certs behind Cloudflare, BYO certs, and other goodies.
If you configure the Ownership TXT Record listed on your dashboard there, this will successfully issue the certificate in most cases. If that still fails, using a Cloudflare origin cert is the most bulletproof option.