This will happen if the web font project’s domain list is missing one or more of the domains/subdomains where the fonts are being used (e.g. an overlooked test/staging domain), or the project hasn’t been published since they’ve been added.

The reason it happens is that these domains, if not listed, will not receive the fonts. The browser will then cache the 403 response for the font requests and will used this cached response when viewing your main page until it decides to make a brand new request (or until the cache is manually cleared). Based on user input, browsers have used these cached responses for up to an hour or longer before making a fresh request.

The problem can also be further exacerbated in reverse when locating the problematic domain—if you view a page where the font is allowed, the browser will also cache and use this response when you then view a page that is not allowed. The result is that this page will use the fonts from the cache even though it should not normally receive the fonts.