I know that people like to dump on Cloudflare, but it's incredibly easy to enable a built-in CSAM scanner with CloudFlare.
On that note, I'd like to see built-in moderation tools using something like PDQ and TMK+PDQF and a shared hashtable of CSAM and other material that may be outlawed or desirable to filter out in different regions (e.g. terrorist content, Nazi content in Germany, etc.)
It looks like it scans and flags on the outbound (user download of the image), so as long as it sits in front of your instance, it should work just fine.
You're still responsible for removing the material, complying with any preservation requirements, and any other legal obligations, and notifying CloudFlare that it's been removed.
It would be ideal if it could block on upload, so the material never makes it to your instance, but that would likely be something else like integration with PhotoDNA or something similar.