Illegal Request in Learning Suggestion for 200 OK response

200 OK is HTTP layer status.
It does not confirm whether the http payload is ok or not.

if you havent done it, WAF learning should be done only for traffic from legitimate testers, not live user traffic.
you can set vserver with waf learning mode to be used by the legitimate testers.
after learning and policy modification is done, apply the resulted waf policy to vserver of live traffic.