Invalid security token

Does this happen when viewing every Wordfence page?

Normally I have only seen this if I have a Wordfence page open in one window or tab, and log out of the site in another tab.

If that isn’t the case, do you have any caching set up on the site that would cache admin pages? (Most WordPress cache plugins wouldn’t do that, but if you have a different type of cache set up, it might treat admin pages the same as any other.)

It could also be a browser issue, if you have any extensions/add-ins for the browser itself that might modify requests, or using a proxy if it is not configured correctly.

This happens just when trying to start a scan, i.e. clicking on the scan button.
There is no site caching, and it happens with any browser.

Something else about the site I noticed was that when starting the wizard with Post SMTP plugin, it displays all 4 steps in one page without a save button.

It would seem that some site functionality is missing.

This might be from a conflict with another plugin or the theme. Can you try disabling all other plugins, and switching to a default theme like “twentyfifteen”?

You might need to log out of the site, and log back in after doing this, before checking if the scan works. (If it works, you could try enabling the other plugin you mentioned, and see if either one has an error.)

You can also check the javascript console while viewing the Scan page, before trying the button, and again after clicking it, to see if any errors are logged. If you’re not familiar with the javascript console, see this page:
How to open the javascript console