Just wanted to add that I also have this problem regularly, using a variety of themes… It’s always mod_security that causes it, but the actual cause seems to be related to wordpress using ajax to auto-save post details, triggering one of the mod_security rules.
Since I have access to mod_security on my servers, I just add my I.P. to the whitelist… that way all the mod_security rules are still in full effect for everybody else. This is obviously more secure than just disabling it, but if you have a dynamic I.P. then it requires more work to keep updating the whitelist.