The WAF rule matches based on the user agent header? Perplexity is known to use generic browser user agents to bypass that.