I am getting a similar issue, although I don’t see any special characters in the request.
[403 GET Request: May 9, 2022 - 1:55 pm]
BPS: 6.1
WP: 5.9.3
Event Code: BFHS - Blocked/Forbidden Hacker or Spammer
Solution: N/A - Hacker/Spammer Blocked/Forbidden
REMOTE_ADDR: 3.105.28.25
Host Name: ec2-3-105-28-25.ap-southeast-2.compute.amazonaws.com
SERVER_PROTOCOL: HTTP/1.1
HTTP_CLIENT_IP:
HTTP_FORWARDED:
HTTP_X_FORWARDED_FOR:
HTTP_X_CLUSTER_CLIENT_IP:
REQUEST_METHOD: GET
HTTP_REFERER:
REQUEST_URI: /wp-json/wc/v3/orders?status=processing&per_page=99
QUERY_STRING: status=processing&per_page=99
HTTP_USER_AGENT: curl/7.68.0
