Mailgun leaking server's real IP behind Cloudflare

Not really, Cloudflare is only used by the client connection, any oneboxing or image embedding by URL is done directly. It’s very easy to bypass and precisely why we regularly have to stress that Cloudflare isn’t a substitute to a firewall.