Harrison Sherloque Wells mentions that every time he caught Cicada it was always David Hersch. This is a reference to the DC comics character David Hersch, which was the civilian name of Cicada.
Nora says that "not even the League" could catch Cicada. This is a reference to the Justice League, the premier superhero team of the DC universe, of which various versions of The Flash, most notably Barry Allen and Wally West, have been members. Other Arrowverse superheroes, Supergirl, Green Arrow and the Legends of Tomorrow are said to have also failed in catching him.
Cicada's first victim was supposed to be Floyd Belkin, although this seems to have been changed by Nora traveling back in time to meet her father. In the comics, Floyd was a character known as Arm-Fall-Off-Boy.
The last 4 numbers Caitlin used to unlock the door to her mother's file room were "2889". Caitlin revealed that the passcode was her birthday, which means she was born February 28, 1989, Danielle Panabaker even confirmed it.
The criminal that Ralph stopped at the store is the same man from The Elongated Knight Rises (2018) as the suicidal bomber.