Hi Jaffer,

This CORS issue is troubling many. I remember doing something with remote site settings. Not very sure but can you try adding your own domain, in this case,"https://lightningcheck-dev-ed--c.ap2.visual.force.com", in Remote Site Settings. It would make it an allowed domain to serve the  request.

Another issue can be related to the Critical Update "Serve Static Resources from force.com domain", but I think this won't impact API calls. You can try to deactivate this update and check - in case you have installed this. - https://success.salesforce.com/issues_view?id=a1p300000008XRLAA2

Another option that I can think of is using Canvas SDK. It has built in cross domain proxies which can help resolve this issue. Refer  https://developer.salesforce.com/docs/atlas.en-us.198.0.platform_connect.meta/platform_connect/canvas_app_xhr_intro.htm  (https://developer.salesforce.com/docs/atlas.en-us.198.0.platform_connect.meta/platform_connect/canvas_app_xhr_intro.htm ​)


Instead, you can  create a custom apex rest service and exposed it to a public site. Here is the blog post (https://developer.salesforce.com/blogs/developer-relations/2012/02/quick-tip-public-restful-web-services-on-force-com-sites.html" target="_blank) with an example on how to do that. As this was custom apex rest service, we were able to modify the response as required. Hence, in the custom code, we added a parameter 'access-control-allow-origin' in the response. 
 
As our goal was to insert a record in the system and send back success or error result, the public apex rest service worked for us. 

Kindly mark this post as solved if the information help's so that it gets removed from the unanswered queue and becomes a proper solution which results in helping others who are really in need of it.

Best Regards,
Nagendra.P