Why do additional requests above the threshold configured for my rate limit rule get passed to my backend server?
You might not see requests immediately blocked by the rate limit when requests are processed by different Front Door servers. For more information, see Rate limiting and Front Door servers.