It looks like after the sensors makes another register call, the condition clears and the sensor starts sending data back to the correct minion.
403 is returned for the event log reserve call as the master does not have a events core in solr.
Environment
EDR Sensors: All 6.1.x and 6.2.1 sensors
EDR Servers: All versions
Cause
Windows 6.1.x sensor can get confused and start sending /data/storefile/reserve and /data/eventlog/reserve calls to an eventless master which is invalid.
Resolution
CB-17170 is fixed in sensor version 6.2.2 and later versions.
Additional Information
This behavior may cause the messages
worker_connections are not enough, reusing connections