I have set SameSite=Lax on cookies using apache config header rule (Header edit Set-Cookie ^(.*)$ "$1;SameSite=Lax") in my application(xyz.example.com) which is picked up and set appropriately by the browsers. However, while making a cross domain GET request to the cdn from an iframe (iframe location - cdn.example.com) within the application, the cookies that are set with domain=.example.com and have SameSite=Lax set are not sent over to the cdn in Safari 13.1.2 but are sent over for other browsers(Chrome, Firefox). When sent from the iframe, the resources that respond with a 403(because of missing cookies) have a url similar to cdn.example.com/secure/rss/content.css.
Moreover, when I set the SameSite attribute to None with Secure flag using apache config, the cookies are sent over fine from Safari version 13.1.2.
Based on my googling, this clearly does not have anything to do with the WebKit bug which affected Samesite attribute with value None or something invalid to be interpreted as Strict(even though in my case Safari seems to be considering those cookie to be set with SameSite=Strict) by Safari - https://bugs.webkit.org/show_bug.cgi?id=198181. 13.1.2 version of Safari still has that issue when checked with https://samesite-sandbox.glitch.me/
Apart from the difference in behaviour for SameSite=None in Safari and disabling "Prevent Cross site tracking", I could not find any clear reason for this deviation in behaviour for SameSite=Lax in Safari.