Putting a CDN in front and leaving the origin A record in old emails is not hiding. Attackers and scrapers will use the IP they already have. Cut over, then restrict.
The public name is the distribution
Apex and www should flatten or CNAME to Cloud CDN. History records, staging names and forgotten subdomains are how origin stays public.
Firewall the pull
Allow Cloud CDN to fetch. Deny the world. If you use more than one CDN, allow every pull path. Validate origin TLS.
Look for leaks
Mail headers, old NS records, certificate transparency for unused hosts, and application code that prints server IPs. Clean those.
Emergency is easier when this is already done
If you are under attack and origin is still public, hiding it is part of the incident. Doing it on a quiet Tuesday is cheaper.