ModSecurity 912-DOS-PROTECTION rule doesn't work - apache

Question

I'm using mod_security 2.9.2 with OWASP Core Rule Set version 3.3 running under Apache 2.4.
To try to stop simple DOS attacks, I've enabled the rule 912-DOS-PROTECTION, but it's not having any effect.
To enable the rule, I added the following to my mod_security.conf as suggested by the documentation in REQUEST-912-DOS-PROTECTION.conf:
SecAction \
"id:900700,phase:1,nolog,pass,t:none,\
setvar:'tx.dos_burst_time_slice=3',\
setvar:'tx.dos_counter_threshold=50',\
setvar:'tx.dos_block_timeout=600',\
setvar:'tx.static_extensions=/.jpg/ /.jpeg/ /.png/ /.gif/ /.js/ /.css/ /.ico/'"
This rule should activate when the server gets more than 50 non-image requests over a 3-second period.
However, it doesn't have any effect on my server, and does not stop any incoming requests.
To simulate real traffic, I use the utility ab to create connections to my server.
For example, here's a test that uses 60 concurrent connections over a period of 6 seconds:
ab -c 60 -t 6 "[URL]"
I get the following output from a sample run:
Concurrency Level: 60
Time taken for tests: 6.018 seconds
Complete requests: 611
Failed requests: 0
Write errors: 0
Total transferred: 110954039 bytes
It appears all requests were successful. This is not what should happen. I would expect that, shortly after the test starts running, the DOS detection would be tripped, and subsequent requests would be blocked.
My modsec_audit.log does occasionally log some messages while I run these tests (but not on every run). Here's an example:
Message: Warning. Operator GE matched 2 at IP:dos_burst_counter. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-912-DOS-PROTECTION.conf"] [line "269"] [id "912170"] [msg "Potential Denial of Service (DoS) Attack from [IP] - # of Request Bursts: 2"] [ver "OWASP_CRS/3.3.1"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "paranoia-level/1"] [tag "attack-dos"] [tag "OWASP_CRS"] [tag "capec/1000/210/227/469"]
Apache-Error: [file "apache2_util.c"] [line 273] [level 3] [client IP] ModSecurity: Warning. Operator GE matched 2 at IP:dos_burst_counter. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-912-DOS-PROTECTION.conf"] [line "269"] [id "912170"] [msg "Potential Denial of Service (DoS) Attack from [IP] - # of Request Bursts: 2"] [ver "OWASP_CRS/3.3.1"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "paranoia-level/1"] [tag "attack-dos"] [tag "OWASP_CRS"] [tag "capec/1000/210/227/469"] [hostname "example.com"] [uri "/test.php"] [unique_id "Yu-n6NGj9kT3clHjZubuCQAAAM0"]
Apache-Handler: proxy:unix:/run/php-fpm/www.sock|fcgi://localhost
However, these messages appear only rarely, and it doesn't seem they indicate that any block occurred, as they are associated with log entries that show HTTP/1.1 200 OK. I assume this means that the request was successful, even if the threshold for DOS detection was reached.
Does anyone know how I can get the simple mod_security DOS protection to work as documented?
Thanks!