Are you using custom Bunny settings?
I’m curious, as I use the same CDN without any issues.
Curl
curl -I https:/unicyclist.com
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 09:10:03 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: strict-origin-when-cross-origin
X-Discourse-Route: categories/index
Vary: Accept
Cache-Control: no-cache, no-store
Content-Security-Policy: upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src https://unicyclist.com/logs/ https://unicyclist.com/sidekiq/ https://unicyclist.com/mini-profiler-resources/ https://cdn.unicyclist.com/assets/ https://cdn.unicyclist.com/brotli_asset/ https://unicyclist.com/extra-locales/ https://cdn.unicyclist.com/highlight-js/ https://cdn.unicyclist.com/javascripts/ https://cdn.unicyclist.com/plugins/ https://cdn.unicyclist.com/theme-javascripts/ https://cdn.unicyclist.com/svg-sprite/ 'sha256-Gty3/aPWFfSvz7pdT39HY97/+2opLup9V0L19ZF0IwY='; worker-src 'self' https://cdn.unicyclist.com/assets/ https://cdn.unicyclist.com/brotli_asset/ https://cdn.unicyclist.com/javascripts/ https://cdn.unicyclist.com/plugins/; frame-ancestors 'self'; manifest-src 'self'
X-Request-Id: 40286528-e3e2-433d-9bf0-be971202b973
X-Runtime: 0.070801
Strict-Transport-Security: max-age=31536000