Yes, CSF need to be configured to parse error log file for detected IP attacking the server.
We will leave it for CSF developer or someone familiar with their regex setup.
At last look LSWS writes out the 'mod_security' records slightly differently than actual mod_security. This causes CSF to not parse/pick up the LSWS mod_security log records. I can post more details if necessary.