A behavioral model blocks a request that does not match the traffic it was trained on. A new model, or a model left in place after the application changed, does this more often. Retrain on a schedule. The model operations are in Behavioral model management.
Before the model has been trained again while you check it, turn on detection mode for requests that MLA marks as illegitimate. The switch is in the Filter settings in WMC the sequence is in Activating AI protection.
In this mode the event is recorded and the request is not blocked. After the attacks page shows no mass false blocks, turn the option off. While it stays on, MLA does not block.
This option is not waf_host_dm. waf_host_dm stops blocking for the whole host, including signatures. The MLA option stops blocking only for requests that the machine-learning module marked.
Export the request and adjust the model as described in Behavioral model tuning. Do this for the requests you have confirmed are legitimate.
Do not put the host into waf_host_wl to hide these events. That option stops analysis of the host, including signatures and Mikiri AI. It is described in waf_host_wl.
If MLA falls behind the request rate, follow MLA is overloaded before training a new model on a partial sample.