CFA is not a trusted application (e.g. whielisting) security system.
Instead, it's purpose is merely to block access to certain folders that ransomware most often attacks when attempting to encrypt and corrupt user files. This means that any application trying to access these specific folders will also be blocked, regardless of who created the application or how trusted it might be.
So the question you need to ask about those particular Excel files is where they are stored and possibly what other folders or files they might access, since this is what's actually triggering CFA and not Excel or Word itself.
You can choose to allow an application access to specific folders if you trust it, but the opening you are creating is that the application itself is now a pathway into that particular folder, so if it becomes compromised it can be used to attack the files contained in that location.
Rob