After adding a WAF rule, only certain JSON requests return 403

Reproduces and analyzes a situation where most requests are fine but only a specific payload pattern is caught by the security rule.