I've been struggling with the "Error contacting the Parsoid/RESTBase server (HTTP 403)" error for months (currently on 1.37.1). We disabled ModSecurity and still the issue persisted. And today I finally found the solution. It is probably quite unique to our setup, but maybe this will help someone someday. I realised that we had a Wordpress site at our root domain with Wordfence security enabled in the .user.ini file doing this (stars replace true folder names):

; Wordfence WAF
auto_prepend_file = '/***/***/***/wordfence-waf.php'
; END Wordfence WAF

So in the mediawiki .htaccess I added this to switch this off for the mediawiki subdomain:

#Disable Wordfence from higher level domain
 php_value auto_prepend_file none

And the problem disappeared. I did not expect the Wordfence at the root domain to affect the subdomains but it clearly did.