Hi @idresult,
Can you please try disable one by on below features and if any one disabling solves the issue let me know that.
1) WP Security > Firewall > WP REST API Can you please cross check the Disallow unauthorized REST requests:
2) Deny bad query string – WP Security > Firewall > Addition firewall rules tab. Deny bad query strings: uncheck the checkbox and save
3) Advanced char filter – WP Security > Firewall > Addition firewall rules tab. Enable advanced character string filter :uncheck the checkbox and save
4) 5g firewall rules – WP Security > Firewall > 6G Blacklist firewall rules tab. Enable legacy 5G firewall protection uncheck the checkbox and save
5) 6g firewall rules – WP Security > Firewall > 6G Blacklist firewall rules tab. Enable 6G firewall rules – uncheck the checkbox and save
6) WP Security > Firewall > Basic firewall rules tab > Completely block access to XMLRPC , Disable pingback functionality from XMLRPC
7) WP Security > Firewall > Internet bots ban – Blank HTTP headers Ban POST requests that have a blank user-agent and referer
8) WP Security > Firewall > Bot protection – block fake google bots.
It is strange that it is firewall issue and you allowed the ips still there is issue.
WP security > Settings > Advanced settings – Here you can make sure correct visitor IP address is detect method in dropdown selected as per https://whatismyipaddress.com/ site.