ASM / WAF - Requests getting blocked due to encoded usernames

It sounds like the backend app team may have added some encoding to the username parameter. Better sync with them and if it is base64 you have to enable it Securing Base64-Encoded Parameters . Other than that as mentioned in Working with evasion technique detected violations you may need to increase the number of decodings "Multiple decoding"  if needed. Also the parameter "Auto Detect" option is interesting Using the 'Auto detect' option for a parameter to reduce false positive violations .

I will suggest if the app team has added base64 you may need to upgrade F5 to the latest version because Attack signature check security exposure