This has no answers. Over the last week, our team has actually eliminated several false positives - mainly that this has nothing to do with PHP or Laravel.
We are able to replicate the issue using both nginx and apache, as long as our requests are over 443 and also as long as the document (even a flat html document) is on an nfs server.
I am happy to do either - but it seems disingenuous to leave the old question up.
OTOH, if I edit it, people may think 'hm, I have read this already' and it's no longer the same.
My guess is that I am meant to create a new question, and then delete the old one (or request that it be deleted.