You may also modify vcl_recv to strip the __cfduid cookies set by Cloudflare so Varnish can cache the response. The following VCL will strip all cookies starting with two underscores or including 'has_js', such as Cloudflare and Google Analytics cookies:
Also see: Cloudflare and Varnish