It turned out my random 403 errors yesterday were caused by an incorrect KeyCDN configuration. The problem was the Block Referrer setting that was causing problems with Twitters t.co short URL's.

Twitter automatically shortens URL's using t.co domain, and on redirect to the original URL Twitter adds t.co as the referer header. This will cause KeyCDN to return a 403 Forbidden error if your Block Referrer settings are incorrect.