Okay, I found something. I'm looking at a flower photo posted privately by @Mike Macgirvin 🖥️ a few days ago.

In my stream, I can see the image in the post, and its URL is at fediversity.site:
https://fediversity.site/.well-known/apgateway/did:key:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/photo/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx-1.jpg?token=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&zid=billstatler%40forum.statler.ws

However, if I look at recent posts by Mike (on my instance), the image URL points at the cache on my instance, and the image is not displayed (returns a "403 Forbidden" error):
https://forum.statler.ws/ca/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx?url=https%3A%2F%2Ffediversity.site%2F.well-known%2Fapgateway%2Fdid%3Akey%3Axxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx%2Fphoto%2Fxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx-1.jpg%3Ftoken%3Dxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

If I enter this same image URL manually, but omit the "?" and everything following, I can see the image:
https://forum.statler.ws/ca/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

So, this brings up three questions:

• I thought that private images were never cached, but it went into my cache.
• Why is the image URL different (original vs cached), depending on where I am viewing the post on my own instance?
• Why do I get "403 Forbidden" only when the cached-image URL contains the extra stuff at the end?

Let me know if I can provide any more data.