ou can use Cloudflare WARP client to connect devices to Cloudflare for DNS filtering or Secure Web Gateway filtering.
anchor apple generic and identifier "com.cloudflare.1dot1dot1dot1.macos" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "68WVV388M8")