I saw the same behavior and it turned out not to be Cloudflare or our backend at all. The culprit was Norton Safe Web’s QUIC/HTTP3 scanning — when enabled, it caused random stalls before DNS/connection. Disabling just that feature fixed the issue completely. Worth checking if affected users run Norton or similar AV software.