According to Configuring Bot Defense | BIG-IP Documentation, having whitelists can speed up access time to the website. Is it because WAF will not check those whitelisted URLs coming to the web site, thereby making it faster? (Faster when users access the web site because less traffic to be validated by WAF?)
You either whitelist a source (IP address or geolocation) or a destination (an URL), or a combination of both.
In any case, if the whitelist entry is matched, the system will skip applying bot defense and thus will save time and resources related to processing bot defense module protections (for example behavioral analysis). In case of thousands of concurrent users, this may be appreciated, but for few users you may not notice any performance effect.
The performance effect will be on client application side or WAF side?