Why do some connections time out and others get refused?

One reason would be the behavior of a firewall on example.com. In the event the firewall simply drops the traffic, you will see the first response. On the other hand, if the firewall rejects the traffic, you will get the second.

To better understand, take a packet filter such as tcpdump or wireshark and sniff the traffic as you perform the tests.

The first case will look like Syn,Syn,Syn...

The second case will look like Syn,Rst along with a possible ICMP port-unreachable.

A successfull connection will look like the Syn,Syn-Ack,Ack we expect in the tcp three-way handshake.