real world experience with WAF WebACL anomaly detection

Looking for personal experiences for anomaly detection for WAF WebACLs using either CloudWatch Anomalies or CloudWatch with Lookout for Metrics. e.g. blocked requests.

Has anyone had profound insights using either? What I mean is, has anyone received any actionable intelligence from either of these approaches that was able to result in a measurable operational improvement or risk mitigation? How were the costs in using these approaches?

Thank you in advance.