There's fears of bots and there's actual bots. My custom WAF blocks 500 requests per second, and let's through 2. There should be nearly zero false positives with the detection method I'm using.