With 9.0.0 dependency-check has moved from using the NVD data-feed to the NVD API.
Users of dependency-check are highly encouraged to obtain an NVD API Key; see https://nvd.nist.gov/developers/request-an-api-key
Without an NVD API Key dependency-check's updates will be extremely slow.

The NVD API Key, CI, and Rate Limiting
The NVD API has enforced rate limits. If you are using a single API KEY and multiple builds occur you could hit the rate limit and receive 403 errors.
In a CI environment one must use a caching strategy or use a set API KEY to use for different jobs.