403 forbidden for all css files located in /modules
That extra query string are used to control caching. That will change everytime the cached files expired. 

As per Dave Reid: 


  It's to prevent browsers from caching those files when they change.


See these threads: 

https://www.drupal.org/node/346711
https://stackoverflow.com/questions/11362261/appending-query-string-to-all-js-and-css-files-to-prevent-caching