Private files get Access Denied for any non-admin role but only on server
The issue is due to the File Entity module. This was still enabled on our site even though it has been deprecated. Once it is uninstalled; private files work as expected.