How long does it take for CF to adjust? IF the web host can recreate the problem, means problem was solved then they broke it again to re-create the issue. What did they do to re-create it? Does your web hosting have any thing in front of the moodles acting like CF? mod_security/su-php/selinux on the system itself?
Remember that apache logs only show either errors or access. There is no log of which am aware that looks at request for external files your Moodles are making for outside files. Only evidence of that would be the date/time stamps on files moodle caches.
'spirit of sharing', Ken
