Thanks for your reply. I didn’t mean to imply that Cerber generates the bad requests, merely that Cerbers traffic inspector labels the requests by the events plugin as such.
Nevertheless, we could resolve the problem by adjusting the options for the Cerber anti-spam engine, as suggested in the instructions you provided.