Forbidden Error

I have started to experience the following forbidden error where there should be a link to a downloadable pdf:

Forbidden
You don't have permission to access /crm-sample/cart_item_uploads.php on this server.
Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request.

I am using cmsb 3.11, php 7.0.27

Looking through the forum I thought Modsecurity may be the issue, and in General Settings Security Modules: ModSecurity 2 is highlighted in red. I can turn modsecurity on/off within cpanel, but turning it off does not remove the error (in General Settings or on cart_item_uploads.php).

The forbidden error appears affect pdfs randomly. I have attached two screenshots. Both are of the same page, as you can see after a refresh different files are affected.

I have run the legacy scanner and all of my plugins are up to date with the latest versions.
I have tested on Safari and Chrome.

Any guidance greatly appreciated!