Denying obvious malicious requests having actual payloads like SQL injections or XSS attempts would be building a web application firewall (WAF), which is a useful defence-in-depth strategy against unknown or unpatched vulnerabilities. Denying requests that would already result in
404 errors does not add any security from that perspective, but it might still be a good idea to do it on the reverse proxy as it reduces the load on the backend server(s).
It does not otherwise matter whether you reply with
403 but using a different status code you give free hints on what you have denied manually. Consider moving the task to the reverse proxy but continuing using the status code
Also, take a look at the
proxy_cache_valid directive; if appropriate, you could e.g. cache all
404 responses for an hour with
proxy_cache_valid 404 1h;.