Ah, I think I see the issue.

APIGateway.getCognitoAuthorizer

is creating a new authorizer for every endpoint, and there is a limit of 10 authorizers per stage. There doesn't seem to be any docs on that function, but it would be nice if it reused existing authorizers when they are from the same pool.