Hi there,
520 would be due to your webserver sending something abnormal. a 521 would be webserver appearing as down when we try to connect.
These could both be connected to the mod_security you’re describing within Plesk or it could be unrelated, trial and error would be best to test theories. EG: does your site work perfectly with mod_security off, if yes, then it probably is mod_security.
I’ve used Plesk extensively myself in the past.
My advice here would be to check the mod_security logging to see if you can see the reasoning behind it.
That should help you in terms of fixing the issue at your origin webserver.
If you are on a Cloudflare paid plan then our WAF would be great in terms of protection.