Random 401 Error on API calls
### Node Version

18.20.5

### NPM/Yarn/PNPM Version

NPM 10.8.2

### Strapi Version

4.25.18

### Operating System

Linux (Debian/Ubuntu)

### Database

PostgreSQL

### Javascript or Typescript

Typescript

### Reproduction URL

_No response_

### Bug Description

Calling the Strapi APIs deployed on Azure App Service from the React front of our project can generate random 401 Unauthorized errors.

When it happens, the console shows the following CORS error : 
```
Access to XMLHttpRequest at 'https://my-strapi.com/api/collection' from origin 'https://www.my-app.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
```

However, the preflight OPTIONS request returns a 200 OK.

I am wondering if the problem truly stems from CORS configuration or another issue.

- I have reproduced this problem on different environment slots in Azure App Service.
- I have not reproduced it on local environment.
- All our APIs seem to be affected.
- I was not able to find a pattern to these random errors.

### Steps to Reproduce

1. Create a Collection type in Strapi deployed in Azure App Service.
2. Add data to the Collection in Strapi.
3. Create a token for the Collection API in Strapi : 
  - Token duration : Unlimited.
  - Token type : Custom.
    - Check "find" on the Collection.
4. Save the token as a secret env variable in front GitHub repository.
5. Deploy React front to Azure SWA.
6. Use front React app to call the Collection API with Axios : The call can be valid or generate a 401 Unauthorized error.

### Expected Behavior

The API call results should be consistent.

### Logs

```shell

```

### Code Snippets

I have confirmed that the problem persists whether the default or a custom CORS configuration is used in ./config/middlewares.ts.

Default configuration : 
```
export default [
  "strapi::logger",
  "strapi::errors",
  "strapi::security",
  "strapi::poweredBy",
  "strapi::cors",
  "strapi::query",
  "strapi::body",
  "strapi::session",
  "strapi::favicon",
  "strapi::public",
];
```

Custom configuration : 
```
export default [
...
{
    name: "strapi::cors",
    config: {
      origin: [`${process.env.APP_LINK}`],
      methods: ["GET", "POST", "OPTIONS"],
      headers: [
        "Accept",
        "Accept-Encoding",
        "Accept-Language",
        "Authorization",
        "Baggage", // For frontend Sentry monitoring
        "Content-Language",
        "Content-Type",
        "Origin",
        "Range",
        "Sentry-Trace", // For frontend Sentry monitoring
      ],
      keepHeaderOnError: true,
    },
  },
...
];
```

### Media

_No response_

### Additional information

_No response_

### Confirmation Checklist

- [x] I have checked the existing [issues](https://github.com/strapi/strapi/issues) for duplicates.
- [x] I agree to follow this project's [Code of Conduct](https://github.com/strapi/strapi/blob/develop/CODE_OF_CONDUCT.md).