Actually, the reverting to Learning mode seems to coincide with Wordfence’s own scanning. I’ve disabled auto scan for now, and the mode stays enabled. When I manually start a scan, I can see the firewall being reverted to learning mode within a few minutes.