Hey @James_Wilson - thanks for flagging this. This could potentially be related to bot protection on our end, although we have seen similar false positives with legitimate storefront traffic (429 errors in this case): Aggressive bot detection with 429 errors AJAX Cart API - #103 by Paige-Shopify
Could you share a request ID from one of the 403 responses? If one isn’t available, an approximate timestamp with the timezone and the exact Ajax API endpoint that returned the response for a timeframe where you saw a large surge would be super helpful so I can correlate in our logs here. Hope to hear from you soon!