I have seen issues in scenarios like this with "nested" permissions. Explicitly grant your account enroll permission and try again. The CA log is clear about the access denied, so there is a permissions issue.
Are you using the link to submit an Advanced request with an existing CSR? If so, is your account (which you are logged in with) on the enroll permissions on the template?