Apache config is below. I've taken out a few directory names but left the name of my site. Looking at it, I'm wondering if the problem is the order of the directives. Note that adding nocanon to ProxyPass was an attempt to fix the problem. It doesn't seem to have made any difference.

DocumentRoot /.../festipedia
ServerName www.festipedia.org.uk
ServerAlias *.festipedia.org.uk festipedia.org.uk festipedia.uk *.festipedia.uk

Alias /awstatsclasses/ /usr/share/java/awstats/
Alias /awstats-icon/ /usr/share/awstats/icon/
ScriptAlias /awstats/ /usr/lib/cgi-bin/

Alias /cacti "/usr/share/cacti/site"

Alias /wiki "/.../festipedia/w/index.php"

2. This is to permit URL access to stuff needed for awstats.

<Directory /usr/share/awstats/icon>
Options None
AllowOverride None
Require all granted
</Directory>

<Directory /usr/share/java/awstats>
Options FollowSymLinks
AllowOverride None
Require all granted
</Directory>

And the same again for Cacti

<Directory "/usr/share/cacti/site">
Options None
AllowOverride None
Require all granted
</Directory>

<Directory "/.../festipedia">
Require all granted

RewriteEngine On
RewriteBase /

SetEnvIfNoCase User-Agent "^libwww-perl*" block_bad_bots
Deny from env=block_bad_bots

Redirect / to Main Page

RewriteRule ^/*$ %{DOCUMENT_ROOT}/w/index.php [L]

require non-empty HOST header

RewriteCond %{HTTP_HOST} !^$

require case-insensitive HOST to be www.festipedia.org.uk

RewriteCond %{HTTP_HOST} !^www.festipedia.org.uk$ [NC]

301 redirect everything to correct www.festipedia.org.uk

RewriteRule ^(.*)$ https://www.festipedia.org.uk/$1 [R=301,L]

Redirect /statistics to /awstats/awstats.pl

RewriteRule ^statistics/?$ https://www.festipedia.org.uk/awstats/awstats.pl [R=301,L]
</Directory>

<Directory "/home/frheritage/www/festipedia/images">

Plug an XSS vulnerability for old IE clients

RewriteCond %{QUERY_STRING} \.[^\\/:*?\x22<>|%]+(#|\?|$) [nocase]
RewriteRule . - [forbidden]
</Directory>

Expose the REST API at /api/rest_v1

ProxyPass /api/rest_v1/ http://localhost:7231/www.festipedia.org.uk/v1/ nocanon

CustomLog /var/log/apache2/festipedia.access.log "combined"
LogLevel emerg

SSLEngine on
SSLProtocol all
SSLCertificateFile /.../certs/festipedia.crt
SSLCertificateKeyFile /.../certs/newprivate.key
SSLCACertificateFile /.../intermediate.crt

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

I've now found the problem by turning on debug logging in Apache. There is no problem in the code. The issue is the documentation.

To make this work correctly, you need the directive:

AllowEncodedSlashes NoDecode

in your Apache config or it will simply give a 404 error for any urls with encoded slashes.

You also need to add nocanon to the ProxyPass directive otherwise Apache will encode the % character, which results in the request being rejected.