Well it depends, the WAF has multiple levels of strictness that will break origins if too strict. If an origin can tolerate the more strict levels, then it would be hard to bypass.