Since the waf_blocked alarm is triggered when the % of blocked requests is more than 25% for a given period, the alarm can be tripped by a low number of blocked requests as long as the number of allowed requests in the same period was also low.

Blocked requests (WAF logs)

All requests (API Gateway logs)

Alarm raised