I had a similar issue once with an app hosted on Azure. Large images were triggering the WAF sometimes as a ‘chunk’ of the image would falsely match a default firewall rule.

The CORS error was because the ‘request blocked’ response was a html page without cross origin headers.

Worth checking for that