I just wanted to come back and close the loop on this.
VMWare support was of no help. They told me to come here. No surprise there. I did figure out the issue, just now, though.
When the 'nagios' user was given the read-only role on node 3, we didn't check "Propagate to all child objects." We must have done it on the rest of them. Removing the user and re-adding it with that checked fixed the issue. I removed and re-added again, without the check box, and the problem came back. IMO, the VMWare API should have been returning a 403 since the user didn't have permissions to the object it was querying.