After a week of debugging, finally found where is the issue comes from.
The cronjob automatically update all the files inside vhost folder.
I run the command below and it triggers 403 forbidden error on my all three websites.
"/scripts/cwp_api account update_bandwidth_all"
This command is found in /etc/cron.daily/cwp_bandwidth .
Please help to resolve, thanks!