The validate_config handler seems to trigger on events hitting old, closed PRs. It loads the triagebot.toml from the PR itself, which might be very old, and fail. rust-lang/rust#73206 (comment) is an example.
I think at a minimum it probably should not run on closed PRs. I'm not sure if it should ignore other events, but that seems like a start.