There’s definitely something interesting going on. We can ‘curl’ to the origin, but if it’s routed through Cloudflare, it gets a 403.
I don’t think we’ve asked, but have you checked the Firewall Events Activity Log at dash.cloudflare.com? If you Add Filter for that subdomain Host(name), it should make the list easier to scan.