How to investigate iCloud certificate trace logs?

You are viewing all names for the DNS where that same certificate is valid. No, it does not mean you are subject to a man in the middle attack or that website is being accessed or that website has access to your computer. None of that is true, instead of needing a different certificate for each domain, the SAN (Subject Alternate Name) allows this same certificate to be used on multiple domains. In this case the same certificate is used for:

• icloud.cdn-apple.com
• www.icloud.com
• icloud.com
• auth.apple.com
• www.icloud.com.cn

It may be helpful to read about what you are referring to instead of just jumping to conclusions. Users in other regions are still directed to the iCloud website without the country code identifier, but as you acknowledged, on the closed system in China, accessing iCloud will be through that domain with the country code. This one certificate validates the iCloud website everywhere instead of needing 5 different certificates for each domain. You can also see the benefits of this multi-domain approach by reading this:

https://www.entrust.com/blog/2019/03/what-is-a-san-and-how-is-it-used

The assertions in your post are completely false. This is "normal and expected". Not sure where you are getting your information from or if you are just completely making up your own conclusions. Please provide sources to those statements as I have.