Cloudflare masks the origin of roughly 10% of abusive domains, watchdog says.