It appears likely that the US government could adversely affect Cloudflare's business via legal action if they wished. The fact that they have not is therefore unusual. However, it is well known that US federal law enforcement is happy to avoid shutting down illegal activities if they believe that they can obtain more intelligence by not doing so.

From previous programmes like PRISM, it is well demonstrated that most large tech companies are perfectly happy to comply with requests for total access by intelligence and law enforcement agencies. Moreover, given that Cloudflare is now used by an absurdly large number of websites, this means that Cloudflare is essentially the world's premier global MitM agency. This is a level of access and visibility that signals intelligence agencies could ordinarily only dream of, especially since it breaks TLS. To put it frankly, the intercept data available to Cloudflare is so tantalising to intelligence agencies, it seems almost beyond plausibility that they haven't gone after it, especially when considering the possibility of effectively blackmailing Cloudflare over the legality of their activities and, for that matter, the known historical contact of their founders with DHS. (Though even this assumes a default reluctance to assist extrajudicial surveillance on the part of tech companies, which is known to frequently not be the case in favour of indifference or outright enthusiasm.)

In other words, on the balance of probabilities, I believe that Cloudflare's continued lack of aggression from the US government and simple consideration of the standard MO of both intelligence agencies and tech companies makes it overwhelmingly likely that Cloudflare is an effective element of US signals intelligence.