Real users are being challenged. Check the decision log for the risk components; mobile carriers behind CGNAT often share reputation. Lower the challenge threshold for the affected route or allow-list the carrier ASN.
502 from the edge. Your origin refused or timed out the connection; check that edge ranges are allow-listed.