Opening the dev console in Safari and Chrome, there's an injected https://static.cloudflareinsights.com/beacon.min.js tag at the very end of the body. If I curl the site, it's not injected, but if I copy as cURL from Chrome's dev tools and run that curl command, the script is injected again.