Seems to me more like they've deployed some default WAF in front of their web properties, without considering the specific needs for the CRL endpoints.