I think that you're right, it's related to Cloudflare's SaaS SSL product [1].
I'm totally ignorant of how it works but I guess that because everything is taking place within Cloudflare's network they're not hitting the DNS record after it's initially set up, they're just routing the traffic internally.