CiviCRM Mailings external links forbidden
You're correct, this is not CiviCRM-related.

Your Apache log is showing that mod_security is the culprit here.  mod_security is a "web application firewall" - it sits between the user and Drupal/CiviCRM.  It's used to block access to the application when it thinks the interaction is malicious.

From the log, I can see that it's blocking part of the cookie associated with ajs_user_id.  A quick Google search says that ajs_user_id is probably tied to segment.com's analytics.js.  Does that ring a bell?

The answer is to go to your webhost/sysadmin and show them this error; they should be able to change the mod_security logs.  If they refuse, I recommend changing webhosts.  If that's not an option, disable analytics.js.