Cloudflare might be limiting you based on content type. I do not know what type of connections Moon+ uses to communicate with Calibre. It may not be the same as the HTML content that travels between a web browser and Calibre's web interface.
Cloudflare USED TO potentially block you from sending "non-HTML" content. But they have changed their terms of service recently. They may allow it now. Hard to say in your specific case. Here is a Cloudflare blog on the confusion and changed TOS for what they will transmit for you:
https://blog.cloudflare.com/updated-tos/
This may or may not give you some hint as to what may be happening in your case. I don't know personally (I don't use Cloudflare tunnels), but I did investigate them a little bit back in the past and decided the privacy/control issues were not for me. So my knowledge about it was never very high, and mostly forgotten at this point. But you might want to investigate the above link to see if that's something you could be running into.