Attackers need to identify what applications are hosted on your domain. They can identify them by scanning for common files and directory structures on your platform. For example, if you run Wordpress, an attacker can look for
/wp-admin, and if it returns a 200, they know you are running Wordpress.
Once they know what framework or application you are running, they will start to navigate through known vulnerabilities, or even a 0day, until they are able to compromise your platform.
Now, keep that in mind because CloudFlare simply serves as a ReverseProxy to help protect you. This means, that the incoming requests to your server will be sourced from CloudFlare, not the attacker.
Think of it this way:
[Attacker] -----> [ YourSite ]
[ CloudFlare ] -----> [Your Server Request]
[ CloudFlare ] <----- [Your Server Response]
[Attacker] <---- [ YourSite ]
CloudFlare looks like your physical server to the attackers. They perform queries, gets, posts, etc to your domain. CloudFlare receives the request first, and then performs some inspection on the request and forwards it to your physical server.
So when you see the requests coming in from CloudFlare, it's because they are serving as a reverse proxy. The
/undefined could still be an attacker trying to identify known vulnerabilities on your site.