Good news! I have very likely found the culprit. Because of a previous Yoast SEO plugin vulerability, Cloudflare has a trigger for a post variable “orderby”. This was detected falsely and triggered the block on our ends.
I’m attaching the patched version to this post, please install and activate it. After that the issue should go away.