404 is also returned when there are some permissions issues.
Try to give %All to the user that you calling this API with and see if it helps. If yes -- then this is permissions issue.
Or enable Audit and auditing for Protect event and see if it is logged in Audit when the problem happens

Other idea -- enable ISCLOG, reproduce the problem, disable ISCLOG and see if there are any errors there. ISCLOG is very verbose, so just do one HTTP request with ISCLOG enabled

enable:

%SYS>kill ^ISCLOG,^%ISCLOG
%SYS>set ^%ISCLOG = 3

disable:

%SYS>set ^%ISCLOG = 0

analyze:

%SYS>zw ^ISCLOG (yes, without %)

What error did you get?

Are you sure, that the error is inside %CSP.Broker?

%CSP.Broker is a dispatch class to call server-side methods.

In most cases the error happens in the application method that is called via %CSP.Broker.

Enable logging for CSP Broker and see if any additional information is logged in ^ISCLOG:

USER>zn "%SYS"

%SYS>kill ^ISCLOG, ^%ISCLOG

%SYS>set ^%ISCLOG("Category","CSPBroker")=3

%SYS>set ^%ISCLOG=3

To disable logging:

%SYS>kill ^%ISCLOG

If %CSP.Broker is used to call ZEN Methods then enable also ZEN logs:

%SYS>do ##class(%ZEN.Utils).%StartLog()

%SYS>do ##class(%ZEN.Utils).%ShowLog()
1  13:40:51.606 OnPreHTTP               /csp/sys/%CSP.Portal.Home.zen
2  13:40:51.809 InvokeInstanceMethod    138@%ZEN.Auxiliary.jsonProvider:RefreshFromServer
3  13:40:51.830 InvokeClassMethod       %CSP.Portal.Home.GetNamespaceList
4  13:40:51.845 InvokeInstanceMethod    169@%ZEN.Component.html:ReallyRefreshContents

%SYS>do ##class(%ZEN.Utils).%StopLog()

Mark, you need to close connections from Web Gateway to IRIS, so that Web Gateway reconnects and CSPSystem logins with the new role. You can do this in Web Gateway -> Status page -- close button for the second table. Or just restart the web server.

Note -- Roles field in the Audit details. Check that it has %DB_SRFT role when happens again.