Turns out this happens for any Guest GET HTML request to an action not skipping check_xhr filter for some reason. I couldn’t find such actions in standard Discourse, though, so probably only some plugin developers suffer from this issue. To us this started to happen after we added a custom page with xhr-provided content for Guests, and stopped when we added preloading to it (which requires skipping check_xhr).
This tricky issue can be fixed with very simply by running add_noindex_header before check_xhr.