Is it normal to have HTTP 499 errors in 1 out of 4000 requests?

Remember that nginx logs a 499 when, from its perspective, the client it was talking to closed the connection.

Remember also that CloudFlare is not the only thing talking to your web server. It is possible for clients to visit it directly, and many do. If you are using CloudFlare, much of this traffic is Internet background noise and the rest is malicious.

It is very possible that a client which made a direct connection to your server dropped the connection, resulting in the 499. Did you check the directly connected IP address?

As for overall, 1 in 4000 requests is pretty good. I see this a lot more often.