Certain parts of it sound really similar. It might be that this was somehow tickling the Apache (mis)behavior.

I believe I just figured out that the problem with the PF config was that the "keep state" directives weren't balanced for in/out. I think this effectively made the firewall overly aggressive about packet origins.