Have you checked your cloudflare.ini to use the token method as shown below? Token is recommended rather than global key.
https://certbot-dns-cloudflare.readthedocs.io/en/stable/
If so, you are using a relative path name for that ini file. You should probably use an explicit path to ensure it works from other contexts like the renew command in a cronjob or systemd timer.
I am not familiar with the '--vault' options. Those would not cause the error you show I just wonder where you saw those described and why you think the cloudflare plugin supports those.
And, what version is your certbot and how did you install it? (pip, apt, snap, ...)
Show
certbot --version