Yeah, connect with a consumer VPN (obviously doesn't apply to self-managed endpoints) and you may get this. (See screenshot 1).
To be clear, it's not a deliberate decision on Kagi's part (see attached screenshot or https://help.kagi.com/kagi/faq/faq.html#i-get-error-forbidden-when-trying-to-visit-kagi). It's just bloody annoying.
I'm using VyprVPN at the moment, which admittedly isn't as active about keeping its IP address blocks secret and regularly refreshed as some, but I've seen it on a number of others.
(I test VPN services for some clients, so have a bunch).
Proton, Nord and SurfShark are all usually let through, because they're very robust about cycling IP addresses. I just tested with Proton (paid-for) and it's fine, for example.
But I like Vypr. More generally, it's going to affect users of cheap/free VPNs a lot more, as well as those (potentially including Mullvad) that don't prioritise region-shifting, so don't cycle their addresses as often.