That's what I assumed since the form is coming from PayPal through an iframe.
I logged into the PayPal Manager account and went to settings. In the middle of the page are some checkboxes to include and require the CVV form field. I checked both include and the edit checkboxes for the CVV (PayPal calls it CSC).
Then at the bottom there is a dropdown to sets how the validation is to be handled. The choices are "light" and "full". I used "light" because that setting allows the CVV to be empty IF the credit card company doesn't require it but if the cc company requires it, the field is required. I might end up changing to "full" if I see a need to.
This worked in terms of showing the form field and my initial test order was successful. So adding that CVV box to the form was pretty straight forward.
Now I am not sure this has anything to do with my original issue here but it's the first thing I am going to try. I have a user that is going to try her order again tonight. If her order is completed then I know it may be the solution to this problem anyway. I will report back.