It can be encrypted if you're using Full SSL on Cloudflare[1], but it's not authenticated, meaning anyone actively MITMing the connection between CF and GH could easily read and change the traffic. That said, it's not any script-kiddie who can MITM a connection between two DCs, so I think it's hardly a grave threat.

I think the only real gain is not allowing CF itself to see who is accessing your blog.

[1] https://support.cloudflare.com/hc/en-us/articles/200170416-W...