The waf-blocked-spike alarm pages because the rate limit is throttling container healthcheck traffic from a few shared IPs, at 10–15k blocks per 5 minutes. That's expected behaviour, not abuse. Raise waf_blocked_spike_threshold from 10,000 to 50,000 so only a flood or a rule blocking all traffic fires it.