Never played with this one. But I assume cloudflare will modify these nginx headers, since it's caching layer.
you can see diffs by requesting
curl -I https://www.domain.com/.../file.woff
vs
curl -I 199.199.199.199/.../file.woff
I get
HTTP/2 200
date: Wed, 03 Aug 2022 14:32:20 GMT
content-type: font/woff
content-length: 90412
last-modified: Tue, 19 Feb 2019 13:44:42 GMT
etag: "5c6c084a-1612c"
cache-control: max-age=31536000
cf-cache-status: HIT
age: 3
accept-ranges: bytes
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VUCoNPsUr2WZxf4%2Bsd0XJgcgwMq4y7hqrey0LQG1a9Y2Gtno7j07DYM01T3EeJ9OsEyZp%2BLMbH%2Bwqf03i%2BNN1etvVz6JZ6w61KX1O3G7WhXfPucFeYG9h3SC2Xxdam4%2BMNsowbvT8d0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 734fc316f984b333-PRG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
vs
HTTP/1.1 200 OK
Server: nginx/1.15.8
Date: Wed, 03 Aug 2022 14:33:17 GMT
Content-Type: font/woff
Content-Length: 90412
Last-Modified: Tue, 19 Feb 2019 13:44:42 GMT
Connection: keep-alive
ETag: "5c6c084a-1612c"
Accept-Ranges: bytes
As you can see, cloudflare adds cache-control header itself.