Long time ago I had that issue too on IIS 10.
Tricks with URL Rewriter and native web.config settings are not working fully.
CORS added in the meanwhile preflight request (method "OPTION" within request headers) which is not supported by default by IIS.
At that period I did a custom WebHttpBehavior to handle all of CORS requests then deployed and configured on each IIS front ends.
Unfortunately my source code is obsolete now.
However, you can find a really well implementation of a custom WebHttpBehavior on the GitHub repo cshandler/WebHttpBehaviorExtensions
The installation and settings are pretty straightforward as the documentation is well done.
Just as reference, the source code I did in the past: vherrlein/iis-enablingcors