There are a number of different ways you can configure cloudflare:
- You can set cloudflare as your DNS provider, most CA considers proof of DNS control as valid proof of domain control. This allows cloudflare to create a valid DV certificate with your domain name.
- You can give cloudflare your private key, this allows you to use OV or EV certificate.
- In higher level plans, you can use keyless SSL, This allows you to use OV and EV without surrendering your keys.
In all cases, yes, cloudflare can intercept and modify any data that passes through it. This is necessary because the main way Cloudflare works is as an edge caching layer, web application firewall, and captcha. All these capabilities requires them to able to see the content of requests as they come and/or modify your pages.
There are a number of ways you can limit the authority of a CDN provider like cloudflare, if you use cloudflare to serve static files, you can serve your main site direct and use subresource integrity or add your own encryption to prevent modifications of files served via cloudflare. If you use a native application as your client (e.g. an Android app), you could pin your site's certificate, or you could require OV or EV certificate.
If you run your main domain via cloudflare, then cloudflare is effectively as powerful as your hosting provider.