I haven't had to deal with this yet, but my understanding is that in the US at least you're not responsible if you don't host it. Of course, cloudflare is a private company and they can do whatever they want with your account.

Implementing censorship lists in FOSS may actually be illegal (again in the US), because it can be construed as "advertising" CSAM. Same thing for 1984 reports, which can be used to find rather than avoid content. The rules are stupid and set us up for failure. IFTAS has been doing some work in this area creating resources for activity pub admins, but they mostly have to do with who not to federate with.