I'm not sure how it works at Google, but adding a random query string usually helps because of how proxy servers handle caching. Proxy servers usually treat an URL with different query string as different resource and cache them separately (e.g. /posts?page=2 is definitely not the same as /posts?page=1).

This is not only applies to caching by ISP, but also includes caching by the website itself as well (some websites put proxy in front of their server to cache rarely changed portion of the site, or even using CDN.).

Anything after "?" is a query parameter that the server can read and then apply additional logic to for a response. In this case, they have code that responds to new logo and returns the new logo instead of the previous one.

From the <link rel="shortcut icon"> presumably.

CDNs get copies of SSL keys so they can do their job: serving data. They are logically part of the serving infrastructure for example.com