In order to function, CDNs have to act essentially as giant opt-in MITM services. When you setup a CDN in front of your site, you will either need to give them your cert, or let them issue a cert (e.g. via let's encrypt).
If they can serve your site with https normally, they can serve any content they want under it.
If they can serve your site with https normally, they can serve any content they want under it.