Cloudfront is a CDN run by Amazon AWS, and is a place where many websites host common assets, especially images and javascripts, and all kinds of other things.
PayPal might be serving images from servers there.
You might be using addons which access resources hosted there.
The only thing Zen Cart v1.x uses on cloudfront is when you login to your admin it checks what the latest version of Zen Cart is, and tells you if that is a newer version than the one your store is reporting, thus inviting you to do an upgrade. It's a single hit to a single tiny .txt file.
Generally speaking it is pointless to be blocking port 80 or port 443 access to cloudfront, as usually there is important information there that your site is needing.
Not sure why you're doing that blocking at all really.