They don't actually do anything, but I think it's hard to tell a story where they make things worse, given that Cloudflare is a cryptographically competent org. It's just getting mixed into the already-secure conventional CSPRNG they're using (almost certainly: just the Linux kernel RNG).
> I think it's hard to tell a story where they make things worse [...] mixed into the [...] CSPRNG
I think it's easy to tell a story where it's slightly worse. I mean, for any budget of storage bits and CPU cycles, any "inferior" random data necessarily pushes out "better" stuff.
The lava lamps aren't being used as a CSPRNG, rather they constitute part of the seed for the CSPRNG.