It’s my pleasure to share what I learned.
“must-revalidate” header is still present. It means Cloudflare needs to re-validate its cache for every request irrespective of the max-age value. You may remove “must-revalidate” header, as long as you use Cloudflare (or any other similar layer). Once removed, please see the hit rate in Cloudflare. And then, you may consider improving the max-age further.
Please know that it is still important to have the “must-revalidate” header, if you remove Cloudflare in the future. Assume that you don’t use Cloudflare and you don’t have “must-revalidate” header. Now, there is no way to let the browsers / visitors know that there is an updated version of an article (mostly home page), until the “max-age” value expires.
Basically, if you can understand what each of those headers do, you’ll be in a better position to fine-tune your configuration to fit your particular site.
Also, please know that I haven’t mentioned about purging the Cloudflare cache. I hope you have a plugin or something to purge the cache. Without such a system in place, using max-age to a very high value (such as 24 hours) may backfire by sending the stale / old data to the visitors.