I also noticed random increase in latency when you put a rest api server behind cloudflare. Since then, I don't put api servers behind cloudflare anymore and limit cloudflare use on traditional websites only. I suspects cloudflare might flag api clients as bots (especially those with non-browser user agents) and do additional check on those requests, thus increasing the latency.
I don't think we do anything that would increase latency for API clients specifically.
But if your API is not implemented on the edge (e.g. in a Worker), and the responses are not cacheable at the edge, and you aren't using Argo, then there's not much else Cloudflare can do to make the request faster. Cloudflare is just proxying requests at that point, and the presence of a proxy will indeed probably add a few milliseconds of latency vs. the client talking directly to the origin. (Of course, you do get other benefits like DDoS protection.)
Is it possible that the timeouts was due to cloudflare blocking some user agent, maybe the browser integrity check/bad browser detection? When the api is used in a web browser, there was no reported issue with latency/timeouts from users and logging. the latency is not much different than without proxying on my end. but when used in an android and ios app with custom user agent I did see occasional large latency and the some users reported random timeouts. Unfortunately I didn't test updating the app to use chrome user agent and simply turned off proxying for that api server (and other api servers that used by non-browser clients). It was happening last year though, I haven't try it again yet.
Ah sorry, I didn't realize you meant that things were outright timing out, rather than just being slower than when not proxied. That seems like something went wrong. I don't think we have anti-bot measures that would cause API clients to time out. If anything they would get an error back or maybe get served a captcha or JavaScript challenge.
