Looking at responses for anything else, there are only 2 over the same period.

Logstash: "Cacheable object with Set-Cookie" AND NOT "action=raw"

Cacheable object with Set-Cookie found!
 beresp.status: 200 beresp.was_304: true
 bereq.http.Host: commons.wikimedia.org bereq.url: /wiki/Portada?uselang=es
 Cache-Control: s-maxage=3600, must-revalidate, max-age=0 Set-Cookie: commonswikiUserID=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/; secure; HttpOnly; SameSite=None
 Server: ATS/9.2.13 ReqId: 6a553348-e9e4-4388-89d9-3c36abb69af0 X-Cache-Int: cp7002 miss

Cacheable object with Set-Cookie found!
 beresp.status: 200 beresp.was_304: true
 bereq.http.Host: pl.wikipedia.org bereq.url: /wiki/James_Trafford
 Cache-Control: s-maxage=745295, must-revalidate, max-age=0 Set-Cookie: plwikiUserID=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/; secure; HttpOnly; SameSite=None
 Server: ATS/9.2.13 ReqId: c86170a9-aef6-4999-af7c-a5dd4af6e4ae X-Cache-Int: cp3066 miss

Those two look like the same problem, so it's probably not caused by action=raw but rather by a race condition that happens to be more common there than elsewhere. This supports my theory that it is caused by cross-domain requests shortly after a central login.

The scenario is like this: You perform a central login on wiki A. This will in the background perform auto-login for wikis B and C. While that is happening, you open a second tab to wiki C. In theory anyone could do that, but it's unlikely as the window for it is only a few seconds, and humans generally can't do two things at once.

However, if we don't think about it as opening a second tab, but as making a cross-domain request, then it's quite a normal scenario. If you have a gadget or user script enabled on wiki A that imports code via action=raw from wiki C, then you get the following reliably every time you login:

• Log in via wiki A
• On the first pageview after log in:
  • CentralAuth JavaScript code will perform an auto-login for wikis B and C
  • Your own JavaScript code imports code via action=raw also from wiki C. These can easily overlap or race with each other.

We came across this before last year at T385310#11436185 with the same race condition.

I don't yet know what factor is causing this to happen only 13 times a day (11 action=raw, 2 regular navivgations). There's some other funnel going on making this rare.

These are both session cookie deletions, so not central login.

Probably a session expiry (or logout on a different device) - the client sends session cookies which are invalid, SessionManager handles that as an anonymous request, but also clears the session cookies.