An internal review by the Centers for Medicare and Medicaid Services into news stories critical of its administrator found that officials at CMS’s parent agency may have been the source of some leaks, according to a copy of the report reviewed by The Wall Street Journal.