Jonathan,
I did a network trace and I see a call to this URL with 200 status code:
https://gisvm.company.com:6443/arcgis/rest/services/System/SpatialAnalysisTools/GPServer/CreateBuffers/submitJob?f=json&inputLayer={"url":"https://services2.arcgis.com/j80Jz20at6Bi0thr/arcgis/rest/services/crime/FeatureServer/0","name":"Crime"}&dissolveType=None&distances=[1]&units=Miles&ringType=Rings&OutputName={"serviceProperties":{"name":"Buffer_of_Crime","serviceUrl":"https://gisvm.company.com:6443/arcgis/rest/services/Hosted/Buffer_of_Crime/FeatureServer"},"itemProperties":{"itemId":"b91b496ffb6e4112910d4137413fcb45"}}&context={"extent":{"xmin":-10777339.890868273,"ymin":4983404.183596585,"xmax":-10751771.704906914,"ymax":4992404.643677153,"spatialReference":{"wkid":102100,"latestWkid":3857}}}&token=fr8HA9v15blKWT8dqEu-DKr0VjndlJarfB5yMSHnHkQvo7aCZnAykMj5-EkB5YLkASZBZCu2p9nEwoyzeCadjvNzmui0N6e37YyHgaW7-Bau0M_P2Kj2Uz3qL0P7StjLWenhzNgOGCVzR-BbOYi6c3ichDL03e4aTW2W5HpXwvndCjU2w7B2I_nvSG08dc134mXEoG-8Rwl0m9wJ_xoQopFPkrouat24wQ-oeYx-p0JmVSj3FWxPiEftmsbYTpSAByNF0irrHv8bv-5W2M7p4w..
The Portal is on-prem, but I grabbed this layer from AGOL and that is why it's trying to reference services2.arcgis.com in the call.
I tried this again with a layer that is hosted in my organization, and I saw a call to the same URL above (but referencing my internal portal instead of services2) and the tool completed successfully.
I went back to Portal and added services2.arcgis.com to the CORS section and tried the tool again, but it didn't work. Is there some other setting I should look at? Or maybe you can't run spatial tools against AGOL content if your on-prem Portal isn't visible to the web since it's sending a reference to my on-prem link in the call to services2?
Thanks,
Igor