I contacted Cloudflare’s support and had them remove the registration. I picked up a different domain and replaced it pretty easily. I’m sure I’m already on a lot of lists but I’m hoping that the WHOIS information will clear and it will slow down the spam.

The question is “Why did it happen this time and never happened before with other domains I purchased?” and the answer is “Because it was a .US domain and you didn’t read the fine print.”

Hmm, they have an article on WHOIS redaction but I’m not seeing how to get them to redact my info. I’ll ask support.

https://developers.cloudflare.com/registrar/account-options/whois-redaction/

I remember doing this in Google Domains but don’t recall seeing the option in Cloudflare