CloudFlare probably has a list of most websites you have visited, though. And the contents of all CloudFlare-"protected" pages get proxied through their edge. They are effectively a Global Active Adversary.

I haven't seen them abusing this power except for some incompetence (i.e. injecting JS into pages that customers didn't sign up for) but maybe they're just really good at hiding it.