Does the behaviour of Origin Shield for CloudFront change after a certain volume of requests?

I have a CloudFront distribution which has Origin Shield enabled, most of the time it behaves as expected and I see a couple of requests per period defined by the TTL, the hit rate is typically >99%. But after a certain point (which appears to be ~1 million requests on a given object) the caching behaviour seems to change and it allows bursts of HTTPS requests to my origin as if there is no caching layer at all. I'll see up to 300 requests in a single second hit the origin, then it goes back to normal caching behaviour again for a few minutes, then the burst repeats. This only happens on objects that exceed a certain number of requests (or it could be a certain rate, its hard to tell which). Does anyone know what is happening here and whether the CloudFront/Origin Shield behaviour is designed to change with number of requests? eg/ it scales up from 1 edge location to N where each then needs to call the origin and fill its respective cache? Thanks