In reply to Scott Hartley.

Had both installed. mod_sec logs would show the correct (restored) IP's, but they would not get banned. Instead, they would just attack until they got bored (or whatever makes them decide to quit)

Even CSF warns of this issue when running a security check. This article talks about it and offers a work around. No idea if it works.