Try the bot protection rule set alongside your OWASP core rule set (CRS), now generally available for Azure Web Application Firewall running on Application Gateway.
Azure Application Gateway helps you build highly scalable and available applications by providing application-level (HTTP/HTTPS) load balancing and delivery control.