That actually sounds like SmartErrors is kicking in because we detect a 404 (page not found is almost always a server side issue).
Do you know the IPs WordFence is running those from? It might be interesting to see what happens if you whitelist their IPs in your CloudFlare Threat Control panel.