Thanks @ncw. Forgive me for being a little green with the debug options (I'm brand new to rclone).
I added -vv --dump headers to the command and re-ran it. The URLs I'm seeing are of this form:
$ grep acknowledgeAbuse out.log
2023-01-31 12:58:04 DEBUG : GET /drive/v3/files/<redacted>?alt=media&acknowledgeAbuse=true HTTP/1.1
...
It seems that this is the same issue described here. I changed my command to impersonate a user who has Manager access on this drive, and it completed without error.