Based on the the information in Analytics: CloudFlare vs Google - What discrepancy is too big?, the discrepancy between Google Analytics and CloudFlare is almost entirely automated bot traffic.
There could also be some visitors that trigger CloudFlare but not Google Analytics because they have JavaScript disabled in their browsers. This number should be very small. In 2010, Yahoo found that only 2% of their US visitors had JavaScript disabled:

I suspect that the number of users that disable JavaScript has fallen over time because more and more websites are rich media that require JavaScript and use AJAX. Many popular web sites just don't work with JavaScript disabled.
Advertisers (and your CEO) only care about real people that see your website and are influenced by the advertising. Bot traffic should be excluded from your visitor stats, but JavaScript disabled should be included. Google Analytics may be under reporting by up to 2%, but it sounds like CloudFlare could be over reporting by 2000% (with a 20x discrepancy). Unless there is a way to filter the bot traffic out of the CloudFlare numbers, I would use the Google Analytics numbers. They are much closer to the number of actual human visitors that use your site.