Maybe it's a cloudflare controlled scanner?

Maybe you published the subdomain in a cert?

Snooped traffic is unlikely.

This is a good question, if you don't publish a subdomain, scanners should not reach it. If they do, there's a leak in your infra.