So I tried this out for myself with an identical record config with Cloudflare on a test domain, which succeeded. Digging into things on our end, it looks like the _acme-challenge record (the acme CNAME for the apex domain) might be getting in your way, though. Would you try removing it, to see if that helps?