Sporadic permissions issue
How this gets started is hard to tell. But once it does it spreads quickly. When a user clicks on a link with /index.php the page will include /index.php in the base url, which then is used for all links generated on this page. The same is the case for search bots, once they hit a link with /index.php they will crawl the whole site with it.

To stop this, redirect the unclean urls. You could use this core patch or Redirect, but as long as the core patch is not committed and the module is not released, you can do this in .htaccess. Place these two lines at the top of the rewrite rules:

# Various rewrite rules.
&lt;IfModule mod_rewrite.c&gt;
  RewriteEngine on

  RewriteCond %{THE_REQUEST} "^[A-Z]{3,9}\ /index\.php(.+)\sHTTP" [NC]
  RewriteRule "^" "%1" [R=301,NE,L]