Why is that?
That’s impossible to answer like that. Clouflare looks at the request bodies, and if the heuristics see something suspicious then it blocks it. However sometimes it triggers a false positive – like in this case. I hihgly doubt it is simple to tell which parameter or argument triggers it, as the request is usually checked a million different ways.
For example I have had similar issues with Elementor and Divi builder – even though it’s super rare, it happens regardless of any plugin, as it’s related to the request. Elementor and Divi had nothing to change as it was an isolated case, as they shouldn’t.
I can take a look at the issue directly if you want to – via back-end as well as FTP access and try modifying some of the arguments to see what might be the trigger. It’s a painful process, and it may not work, but I can try if you want to. Make sure to add temporary FTP and back-end access, as I will have to save & modifiy the plugin files.