i think i've nailed down the culprit, hopefully this will be useful to someone else!
APC has a bug with the "cache slam defense" feature, it throws out inappropriate warnings & terminates the client connection prematurely, leading to the 499 errors I was seeing.
It has never been fully fixed, and the PHP folks say that it is an obsolete feature (ugh... they should make sure it is off by default. in the version that ships with ubuntu 12.04, it is still on.)
The best advice that i've seen is to just disable it in apc.ini --
apc-write_lock = 1
apc.slam_defense =0
So far with those settings, everything seems to work OK.