This is a combination of cache and wp-cron.
wp-cron is a workaround that approximates control of future program execution in WordPress. When someone visits the site, WordPress will first serve the request. But before the process is completely finished, WordPress will trigger wp-cron to check if anything pre-programmed also needs to be done (like checking for updates or publishing anything pending).
This means that on a site that doesn’t get much visitors, checks for updates may happen a bit less often. However, most servers that are reachable from internet do get regular visits from various bots, for instance, so usually wp-cron will work decently well.
But: Your site is “hidden” behind Cloudflare. I.e. most visits to your site never reach through to the webserver, i.e. until a visitor does something that needs to be communicated “home”, like posting a form.
Possible workarounds:
Check with your hosting provider if they can offer you any real linux/unix cron control. But you might still have a situation where something is updated on your server, but Cloudflare continues to respond with a cached version, so you should check with them, too.
There are services on the internet that can be set to visit a particular URL every n minutes. If you create a URL that will reach through, either as an exempted URL or using some kind of cache-busting, then you may be able to change the post status in right time. (But still: How will Cloudflare learn that your content has changed?)
