Chlorine (a choking agent) in industrial concentrations is widely available. In a country like Iraq, the manufacturing and transport of chlorine wouldn't be that secure either, especially after we pulled out, so I suppose its possible that they could have just stolen or purchased that agent. They are putting it into canisters, strapping bombs them, and then detonating those canisters. Most of the fatalities from this delivery system and agent would be from the explosive effects rather than the chemical agent. However, chlorine is certainly fatal in high enough concentrations as was proven in WW I where it killed hundreds of soldiers. For military forces, it's easy to detect (it has color and odor) and protect against (Gas mask or even a wet towel) so any MOPP ready force can handle it. I don't know how evolved the Peshmerga CBRN defense capability is though. I'm guessing not very given the pictures that are out there.
Mustard (blistering agent) is fairly easy to produce given that you have knowledge, equipment, and opportunity to do so. The effects are really nasty, though, and so cooking it up in a kitchen normally lead to very observable effects. Many nations that didn't sign the CWC produce Mustard gas, hence the Syria connection here. Most of the pictures out there that I've seen show the effects of Mustard agent contact.
Sarin is a whole different animal. The components for it are dangerous to handle and it takes dedicated facilities to produce. Storing it, transporting it, loading it, all of that is extremely dangerous. As far as I know, there's only one non-nation group that has been verified to have produced it. If ISIS is able to produce it in a quantity that they can employ it to effect, they have certainly graduated beyond the JV.
