You should see such requests being either challenged or blocked at the Security tab → Events.
Double-check which service is triggered and play a bit with WAF to see. Could be some of your Security settings to tune-up a bit and allow it if it’s being blocked with some Custom Rule or service like Browser Integrity Check/Bot Fight Mode