Do the old domains all have the orange cloud turned on? Does riding off the orange cloud solve the problem? If so, then, as I expected all along, Richard is right and you need to clean up your setup.
But if using cloudflare allows a bad actor (you in this case) to serve someone else’s site on their domain, that seems like a problem.