I don’t think there have been any recent Discourse changes to cause this. However, S3 does have a longstanding weirdness with CORS, which can cause CDNs to cache a version of the asset without any Access-Control-Allow-Origin header. And if it’s a bad-cache issue, that could explain why it only affects some of your users (likely based on their location).
IIRC - S3 will only serve the Access-Control-Allow-Origin header to requests which send an Origin header (i.e. those from a normal web browser). When Access-Control-Allow-Origin is omitted, it does not serve Vary: origin in its response. And so: if the first request for a given asset is sent from a non-web-browser-context (e.g. curl, or some web crawler), then the CDN can cache the version without the CORS header. Very annoying!
The DISCOURSE_CORS setting won’t help at all here. That’s only relevant to the application server, not S3.
On our hosting, we workaround this problem by configuring Cloudfront to add Access-Control-Allow-Origin: * to all responses. That makes sure that the weird S3 behaviour can’t cause a bad result to be cached.
Alternatively, you could configure Cloudfront to include the Origin request header in its cache key, which would then keep the non-cors responses separate from the cors responses.
Amazon have a bunch of documentation on CORS here. I had this link in my notes which apparently was a forum thread on exactly this issue… but it seems they deleted it 