You may also modify vcl_recv to strip the __cfduid cookies set by Cloudflare so Varnish can cache the response. The following VCL will strip all cookies starting with two underscores or including 'has_js', such as Cloudflare and Google Analytics cookies:
sub vcl_recv {
# Remove has_js and Cloudflare/Google Analytics __* cookies.
set req.http.Cookie = regsuball(req.http.Cookie, "(^|;\s*)(_[_a-z]+|has_js)=[^;]*", "");
# Remove a ";" prefix, if present.
set req.http.Cookie = regsub(req.http.Cookie, "^;\s*", "");
}
Also see: Cloudflare and Varnish