Hmm - truly odd! Can’t explain it, other than the unequivocal fact that:
even though you were presumably on an onion, you clicked on a clearnet link, and
the resulting 404 showed a ‘server signature’ indicating the .onion domain (so one way or another you were led back to, or never left, .onion), and
the .onion site was the ‘main’ whonix.org onion site, e.g lacking the forum subdomain, which was why you got a 404 (you hit an entirely different ‘site’ or virtualhost server side). The 404 syntax you showed is the default Apache syntax, that of the main site - if it were a 404 generated by the Discourse forum site, you’d have got a ‘pretty’ 404 page intercepted by discourse itself. Instead the site you got was the same as if you went to https://www.whonix.org/t/updated-screenshots-images-thread/5371/12 except the server signature shows you were on the .onion domain.
As always, let me know if it continues to occur, the precise times in whatever timezone or UTC, etc, so that I can try and correlate with logs, but so far no other theory that would explain it other than some sort of rewrite/redirect rule, and the only one that I can think of in that category that would lead you from clearnet to .onion, is a custom HTTPSEverywhere rule. Truly strange.