How is the DNS/connect/SSL HTTP preamble occurring on the second request to this subdomain, rather than the first?

Question

Help me out here. I\'ve sized the url column to obscure my domain name, but take it from me that the 2nd and 5th rows are from the same assets subdomain that I use.