Hello TomyVO,
The issue here is plainly explained in the status code that IIS issues when handling this request: namely 404.11. Checking the IIS status codes as detailed in the documentation (http://linqto.me/IISCodes) the meaning of this status code is: request contains double escape sequence. The sequence would be the part in bold in the request excerpt you pasted:
2019-11-06 15:52:52 192.168.1.253 GET /media/show/1%2Fa%2F0%2F1%2F1a010a9833862e5745c20d12db63f4c3b72f8ff4_VER12220_Pharma_pack_Fles_glas_all_round_bruin_15_ml.jpg/thumbnail_small - 443 - 81.241.239.118 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/77.0.3865.120+Safari/537.36 https://undisclosed.be/ 404 11 0 9
What we would have to ask is: how was this link generated by your backend server? Was the backend server that doubly escaped the file? If so, the problem is on the backend server. If not what you can try and do is gather a FREB trace for a 404.11 status code and see if the url that is requested by the client is not somehow rewritten by url rewrite.