403 PUT when using different subdomain in origin header but CORS fully enabled (*)

I've been trying to troubleshoot this for days and I've about given up.

**Working request: ** curl -X "PUT" "https://working.exampledomain.com/rest/myendpoint" -H "origin: https://working.exampledomain.com" -H "accept: application/json" -H "authorization: Bearer eyJddXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxOTg5MDMiLCJhaWQiOiIiLCJleHAiOjEuNzQzNDMyNDM1RTksImlhdCI6MS43MzgyNasdfzIjoiIn0.9lh5WqdFojv3uaDJA4lGwOqNARzyvniuXNB1id0R6KY" -H "content-type: application/json" -H "x-api-client-version: 2" -H "x-api-key: oL8oIPrFLBV5DZqNNNDNDfp6T9v5OEYh7FJuDHy" --data-raw "{\"assignment_status\":\"My Update\"}" -v

**403 request: ** curl -X "PUT" "https://working.exampledomain.com/rest/myendpoint" -H "origin: https://NOTworking.exampledomain.com" -H "accept: application/json" -H "authorization: Bearer eyJddXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxOTg5MDMiLCJhaWQiOiIiLCJleHAiOjEuNzQzNDMyNDM1RTksImlhdCI6MS43MzgadsfibGFfaWRzIjoiIn0.9lh5WqdFojv3uaDJA4lGwOqNARzyvniuXNB1id0R6KY" -H "content-type: application/json" -H "x-api-client-version: 2" -H "x-api-key: oL8oIPrFLBV5DZqNNNDNDfp6T9v5OEYh7FJuDHy" --data-raw "{\"assignment_status\":\"My Update\"}" -v

Note: The only difference between these 2 is the 'origin' domain.

NOT working result:

Server Error 403 - Forbidden: Access is denied. You do not have permission to view this directory or page using the credentials that you supplied.

I can't find anything more about the error in logs or anywhere else. I've enabled

CORS is enabled in my web.config file, be even disabling it doesn't seem to make any difference. Here's my CORS entry:

<cors enabled="true" failUnlistedOrigins="true">
    <add origin="*" allowed="false" />
    <add origin="https://*.exampledomain.com" allowCredentials="true">
        <allowHeaders allowAllRequestedHeaders="true" />
        <allowMethods>
            <add method="HEAD" />
            <add method="GET" />
            <add method="PUT" />
            <add method="POST" />
            <add method="DELETE" />
            <add method="OPTIONS" />
        </allowMethods>             
     </add>
</cors>

I'm using the hosts file to point that domain locally, so we can eliminate any outside network issues.

Basic auth is Disabled, anonymous is enabled.

I've enabled Failed Request Logging for 403s, but nothing gets written.

This request is served by Coldfusion. I've made sure all of the permissions are set correctly for IIS user, app pool user etc on the isapi dll (jakarta/isapi_redirect.dll).

It almost doesn't seem like a CORS issue since it does show the NOTworking domain allowed as well as the PUT verb.

Here's the full response when it fails:

first curl response chunk

second curl response chunk

Sorry, I had to post most of this as an image because stackoverflow keeps telling me my post is spam. Any guidance is much appreciated.

Here's the warning from the failed request log: Failed warning