The policy builder has only reached 39 % even after 7 days of staging.

The fastest way to reach 100 percent is to configure a trusted IP address (ideally a machine you control and from which you send only safe, non-violation-generating traffic.) This will allow ASM to build the policy quickly and accurately. We realize that method is not always easy to implement, so the alternative is to keep attack signatures, parameters, file types, and any other entities in staging (the default when using automatic policy building) until you are satisfied that triggered violations are not false positives. To prevent blocking legitimate clients, you can enforce items gradually. Make sense?