I had a similar issue once with an app hosted on Azure. Large images were triggering the WAF sometimes as a ‘chunk’ of the image would falsely match a default firewall rule.
The CORS error was because the ‘request blocked’ response was a html page without cross origin headers.
The CORS error was because the ‘request blocked’ response was a html page without cross origin headers.
Worth checking for that