Yes, although it's not mandatory. From networking and performance perspectives, if the CDN deliver the traffic and scans it for application vulnerabilities on the same server, it should reduce the overall response time of the app and improve the user experience.