Why does my system download directly from security-cdn.debian.org?

[Roberto C. Sánchez <roberto@debian.org>]

I have started noticing something odd with the way apt on my systems
downloads some security updates.

First, I run an instance of apt-cacher-ng on my local network and I have
backends configured for both the normal archive and also the security
archive.  My sources.list looks like this:

deb http://apt-cache.localdomain:3142/security/ stretch/updates main contrib non-free
deb http://apt-cache.localdomain:3142/debian/ stretch main non-free contrib

The corresponding configurations for apt-cacher-ng are:

backends_debian:
http://ftp.us.debian.org/debian
http://ftp.de.debian.org/debian
http://ftp.nl.debian.org/debian

backends_debian_sec:
http://security.debian.org

deb_sec_mirrors:
http://security.debian.org

However, recent kernel updates have instead been retrieved from
security-cdn.debian.org, like this from my cron-apt log:

Get:7 http://apt-cache.localdomain:3142/security stretch/updates/main amd64 samba-common all 2:4.5.12+df
sg-2+deb9u3 [172 kB]
Get:8 http://security-cdn.debian.org stretch/updates/main amd64 linux-image-4.9.0-7-amd64 amd64 4.9.110-3+deb9u2 [39.0 MB]

What is even more unusual is that other security updates seem to come
from my apt-cacher-ng instance, as I would expect for all packages.

This is happening now on all of my machines.  I have grepped the /etc
directories looking for instances of security-cdn.debian.org and the
other Debian redirectors but I have found none.  Has anybody else
encountered this?

Regards,

-Roberto

-- 
Roberto C. Sánchez