If your data is sensitive (more than regular personal data), you may want to use TLS all the way to the web server and decrypt in as few places as possible (ideally not at all). Especially CDN which you do not control should not be allowed to decrypt the data.
That being said, IMHO for most kinds of data, encrypting up to your firewall should be enough, as your local network should be protected. If it is not (you don't have adequate physicals defenses, like cameras, alarms, locks...), you may want to get some. Also all the equipment and networking (3,2,1) should be preferably in one locked room, where only few highly trusted employees have access, as physical access is often as dangerous as root privileges.
You still need to encrypt client to CDN and CDN to firewall (your building), but if your CDN is reputable, you can let it decrypt the data.