Dynamic Request/sec should be lot lower than Static (~1/10). the recommended limit for soft and hard is 20 and 30. but you may raise it whenever you see fit.
maybe those users are behind a proxy?
Info log level should let you see. Yes, 403 error will be given for those reach the connection limit.