There is a System Parameter called report.url. This defines what URL is used to render documents. Chances are, this is not set in your database - which means, that the web.base.url will come in place - and your Cloudflare configuration prevents proper access.

To manage System Parameters, go to Settings, enable Developer Mode, then navigate to Technical -> System Parameters. If the Key report.url doesn't exist, create it and set its value to a URL that is not covered by Cloudflare (i.e. the original *.odoo.com url you got from Odoo).

Alternatively you can try to exclude the Odoo server IPs from running through Cloudflare checks. The IPs however will change over time, so you would need to update them in future.

Simply put, bottom line, the most probable cause is that the "Are you a bot?"-security-check can not be passed by Odoo when trying to render a report (i.e. loading style sheets and other resources, such as images).