Thank you for your answer.
So, I did a test with a fresh installation of Passbolt 3.5 (both versions). And unfortunately I cannot reproduce the problem you encountered.
So, I took a look at modsecurity and what it does exactly. It is actually possible that it is blocking requests depending on conditions. When a creation or an update of an entry, the URL is passed in the request body and modsecurity might see and IP address as suspicious.
Somebody from the community had some issues with Passbolt by installing a fresh modsecurity with default configuration on their server (if you wish to take a look, it’s there Passbolt Modsecurity).
From the forum post, there is a configuration example found on a 3rd party website that apparently makes modsecurity work with Passbolt: