Definately not a cloudfare issue. While going through cloudfare with google ads off, there was no cookie from the offending site. Then this arvo when you were testing the ads, it came back. I'm 100% certain it's a google ad that's serving it. Also - the evercookie won't get flagged by google for malicous site detection. However I can't find any information to back this statement up. It might be worth asking google what their policy on evercookies are?
To help you a bit more. This is the exact URL that luvtrack.net is loading,
http://stat.luvtrack.net/click.js. Please only open the link if you have JS disabled. Basically that is the malicous part of the ad that is being served. It loads the other code that installs the tracking cookie. My information, which is all here to read, 100% points to google ad services as the culprit.