It sounds like DDoS Mitigation challenging potentially malicious requests.
While Vercel’s system-level mitigations (such as DDoS protection) safeguards your websites and applications, it can happen that they block traffic from trusted sources like proxies or shared networks in situations where traffic from these proxies or shared networks was identified as malicious. You can temporarily disable all automatic mitigations for a specific project. This can be useful on business-critical events such as Black Friday.
You can set your project to bypass system-level mitigations to test this hypothesis. Just be aware that bypassing leaves your project vulnerable.