[squeed]

Is it Akamai? Or is it a single site on Akamai? CDN customers can configure their sites in a million ways.

My guess is a single site that was getting DDoS'd added this as an attack signature and forgot about it.

[tyingq]

My money, in this case, is something like Akamai Kona or Shape Security, that does bot blocking. Comparing user-agent against known header order for that specific user-agent sounds like something they would do.

[jnfurst]

This is just a single sites configuration.

[bluesmoon]

Well, everybody knows that in statistics, a sample size of 1 gives you a 0 margin of error ;)