Supporting Asterisk is not my day-to-day job, so apologies to everyone if this reported elsewhere.
Whenever an incoming call is made to Asterisk with the callers CLI restricted, then it is rejecting the call with a 603.
Original Invite message
INVITE sip:+447924571xxx@194.54.xxx.xxx:5060;user=phone SIP/2.0
Via: SIP/2.0/UDP 194.54.xxx.x:5060;branch=z9hG4bK38951383
From: sip:anonymous@anonymous.invalid;tag=1446077424
To: sip:+447924571xxx@194.54.xxx.xxx:5060;user=phone
Call-ID: 249245709@194.54.xxx.x
CSeq: 20 INVITE
Contact: sip:COSPEED@194.54.xxx.x
SIP/2.0 603 Declined
Via: SIP/2.0/UDP 194.54.xxx.x:5060;branch=z9hG4bK38951383
From: sip:anonymous@anonymous.invalid;tag=1446077424
To: sip:+447924571xxx@194.54.xxx.xxx:5060;user=phone;tag=as2c482140
Call-ID: 249245709@194.54.xxx.x
CSeq: 20 INVITE
Server: Asterisk PBX SVN-branch-1.8-r310088M
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
Reason: Q.850;cause=21
Content-Length: 0
Is there some dial plan setting somewhere that checks for this?