Modsec takes a lot of babysitting if you don't use a service that does the whitelisting etc for you, especially if there's many different customers using different CMSes and virtual builders.
Every time something isn't working on any site, you'll be digging through modsec logs and spending time remediating rules.
