I think this might be a firewall, cache or cookie problem.
I can see successful requests to admin-ajax.php have a different cookie set. The heartbeat action, for example, uses different cookies than acf/fields/relationship/query
However, both requests go to https://mysite.com/wp-admin/admin-ajax.php