Status update: I accidentally found out that this is related to the problem described in this thread: CSRF Verification Failed since Sentry upgrade
Apparently we misconfigured something when we were trying to find the right place to define the necessary CSP header, but I was still logged in. Now lots of requests fail - including the one to flag a notice as read - but sentry never displays an error in any way.