OK, my bad on the troubleshooting -- turns out it was only the Rochen-hosted sites that were choking. Something to do with mod_security rules, which (now, apparently) need specific exceptions to allow WordFence scans - exceptions added by the host, not me.
I'm aware that Rochen's security is tighter than most shared hosting, which has to be a good thing I guess, but it's reminded me how important it is to periodically check manually that scans ARE taking place, since WordFence does NOT end any notification if regular scans are failing altogether.
Feature suggestion: Might that notification be an option worth adding?