Cloudflare overrides the _acme-challenge subdomain in their nameservers when they are requesting their Universal SSL certificates for your domain. It’s not something you can see or control on Cloudflare’s side, but it will prevent our SSL validations from being picked up.
But those “Incorrect TXT records” errors can also just happen randomly due to caching and other random weirdness. Usually, trying again after 10 minutes does the trick.