Google could penalize your sitealgorithmically, if they see any site issues with hosting. Cloudflare, and other plugin such as Wp-rocket or Wordfence could just be suspects. Investigate thoroughly.
Cloudflare is used by everyone, much data flows through their proxy. It could have counter effect. Possible the assigned ip has history of blacklist. Investigate property if bots are blocked with Cf. Sometimes you are better off pointing your dns to ip bypassing cloudflare.
Optimizing for Speed to pass core web vitals is not everything. I have seen number of sites rank very well without using caching plugin or cloudflare despite failing core web vitals.
Here are some tips to regain back your rankings..
- Don’t host at bad neighbourhoods.
- Ttfb must be high
- Do not use too many plugins.
- Improve on E-E-A-T can be game changer.
- Check for mixed content warnings, force SSL.
- Check for malware or any security issues.
