I recently deployed my first site on Cloudflare Pages and I had to do way too much research in orer to get my static Astro site to respond properly with 404 to any request that didn’t match a resource on the site. Turns out, that if “your project does not include a top-level 404.html file, Pages assumes that you are deploying a single-page application” — which then helpfully (!!) matches all incoming paths to the root of the site.
You can bypass this braindead assumption simply by adding a 404.html on the root of the site. (With Astro, I added a 404.html in the public/ folder of the project.)