It’s probably the nginx web server rate limits - it has additional short-term request-counted rate limits. The Discourse rate limits are there to protect against bad behavior and generally expire per day. The nginx ratelimits are there to protect against flooding.
As you just noticed in your edit, the nginx ratelimits are on the order of seconds and minutes.