I’m afraid I don’t have any experience with WAF, but a search has turned up a couple of topics which may/may not be useful?
How to build a Discourse Installation with an Open Source WAF
Discourse + Web Application Firewall (WAF) mod_security
Is WAF something you definitely need?