If you're using Cloudflare, your domain should be using their name servers. Meaning yourdomain.com is pointing to something like:
Name Server: elaine.ns.cloudflare.com
Name Server: ray.ns.cloudflare.com
This means they hold the master records for your domain. You most likely have a record within your Cloudflare setup that is pointing requests to IPS CIC... this is typically a CNAME record that IPS gave you when you first became a customer.
Something like forum.domain.com CNAME something.invisioncic.com.
They would most likely give you multiple CNAME records for additional redundancy. Those CNAME records change dynamically and can update literally every few minutes to different IP addresses depending on server load and where the request originates from.
X-Forwarded-For records are not controlled within the DNS layer. It's also not something IPS "provides you".
As per Ezoic:
This means Ezoic is passing the original user's IP address in the XFF field. It's not something for IPS to give to you. IPS already respects the XFF as they need it for their own load balancers. (The web server itself handling your request gets the request from IPS' load balancer, so it would have to use the XFF to know what the true source IP address is instead of the local address of the load balancer.)
Also... IPS does not use A records. A records are for IP addresses. They point to a single source. Instead they use CNAME records. It's a resource pointer that allows IPS to direct a request to any number of IP addresses that might change very frequently without making you have to update your DNS each time they make an update. Using A records works when you have just a single web server hosting a site, but it absolutely does not in a multi-server, highly available environment.
If you manually pinged the CNAME record to get an IP address, it means you won't get updates anytime the CNAME record changes. I would HIIIIIGHLY recommend against this as it means your site could randomly break anytime IPS makes a change to their backend systems. Use the CNAME records instead that they provide to point to a CiC instance.