custom.css file is blocked

If the site is set up behind a load balancer or reverse proxy, this will be caused by https://www.drupal.org/node/425990 → .

Upgrade to a supported version of Drupal for full support.

Also, core/themes does not contain a "cmf" theme in Drupal that is distributed on drupal.org so this is a modified version of Drupal.