what are you using for dns, forwarding or the resolver? Are you using dnssec if using the resolver? There is one site I frequent that just doesn't really resolve very quickly.. With a short ttl.. So if have not hit the site in awhile, sometimes the first hit doesn't work and have to refresh browser because it is taking longer than normal to resolve via resolver.
This can be somewhat misleading to find because by time you look its resolved and cached.. So it doesn't jump out that its dns related.
As a side note - since your behind a nat, your cable "gateway" - modem to me screams no nat.. Ie my cable "modem" sb6120 doesn't do nat.. Modems don't do nat, gateways/routers do nat. If you call it a cable "modem" I would think your not doing nat and getting public on pfsense wan.
Also on your dns if using forwarder are you pointing to the isp box for your dns, or directly to isp/public dns?