Mod_security is a good option proven with time. Especially, if you know how to "cook" it (read this book by Ivan Ristić to learn: https://www.feistyduck.com/books/modsecurity-handbook/).

But mod_security provide a very basic approach based on signatures (regular expressions) which: - very hard to maintain and tune, especially if you have applications with a lot of updates (if you don't tune you'll get false-positives); - they don't cover all the attacks; - it not that fast because you need to match each request to the signature database (it's possible to make fast though as CloudFlare did with LuaJIT and OpenResty).

There are no learning capabilities in mod_security, so you need to dedicate engineers time to tune it. There is a lack of analytics. It will detect thousands and millions of malicious request but never says which of them are targeting real vulnerabilities in your apps.

Anyway, mod_security is just another product. It's plain WAF, with a great community and good CRS (signature ruleset).